Steam workshop maps for Meccha Chameleon found delivering malware
Developers say the game is safe to play.
Image by Cybernews
- Malicious Steam Workshop maps for Meccha Chameleon reportedly delivered malware through unofficial custom levels.
- Security researcher Feint said suspicious maps came from a new account that blocked comments and ratings.
- Developers said the game itself is safe, but a system engineer’s infected PC led to a Discord server hijacking.
- Users were warned to avoid workshop maps, run antivirus scans, and ignore links or instructions from fake Discord posts.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The viral Meccha Chameleon game has been targeted by malicious maps on Steam Workshop.
“The official Discord hijacking issue has been resolved. You can now join without any problems,” one of the game’s developers, who goes by the name of Lemorion, shared in an update on X.
Meccha Chameleon is a video game released in June 2026, created by Lemorion and another Japanese indie game developer, Haganeiro. Within a month of release, the game skyrocketed in popularity, selling more than 15 million copies.
However, the game’s success was overshadowed after it was reported that its workshop maps had been infected with malware.
Malicious workshop maps on Meccha Chameleon
Workshop maps are custom levels, created to help users practice and train, and can be found on community hubs like the Steam Workshop.
However, some custom Meccha Chameleon workshop maps, which are not considered an official part of the game, were infected with malware, according to security researcher Feint.
Feint said that their friends noticed how “a command prompt window briefly appeared while Steam was downloading a custom workshop map.”
After checking the files, they noticed what appeared to be a malware dropper.
While Feint found the map odd, the researcher also checked the account that provided it. They learned that the account is only a week old and doesn’t allow comments or ratings on the listing.
Because of this situation, users are warned not to download Meccha Chameleon workshop maps, and if they have already, they are advised to run antivirus software on their PCs.
Meccha Chameleon loses its Discord server
“The game itself is 100% safe and virus-free. This incident was strictly limited to a single admin account's Discord being compromised,” wrote @mecchachameleon on X.
The post further explained that during the investigation and patching of “a malicious MOD map issue, a system engineer’s PC was infected with malware.”
The hacker bypassed the engineer’s Discord two-factor Authentication and took over the server, banning all the staff members.
The developers shared that only the testing PC has been affected. However, they warned users that the hacker who took over its Discord server may share fake statements and announcements.
“Please do not click any links, join fake servers, or follow any instructions posted on that Discord,” concluded the post.
However, the post was flagged as not an official statement, and some users expressed suspicion about the account as well.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
All issues resolved?
Lemorion, one of the game’s developers, continued to provide updates regarding the game's Discord server after sharing that “the Chameleon Server’s security was completely breached” on July 25th.
Discord also responded to the post, saying it is looking into the issue.
Two days later, on July 27th, it was announced that “the hijacking issue has been resolved” and that users can join without any obstacles.
