Meccha Chameleon Players Are Getting Malware From User-Made Maps
Overview & Key Takeaways
Meccha Chameleon--a multiplayer prop-hunt game that's been blowing up on Steam lately--seems to have hit its first real road bump since it launched in early June. As pointed out by a player who goes by Feint, some of the game's player-made maps are basically just Trojan horses containing malware. One of Feint's friends had mentioned briefly seeing a command prompt appear while they were downloading the map. Curious, Feint dug into the files and concluded that the map known as Lazer Tag Zero contained a "malware dropper."
The map was quickly pulled from Meccha Chameleon's Steam Workshop page after Feint published their findings in a Medium article. But the chaos was just beginning. Other malware-filled maps started appearing, and then the game's official Discord server was hacked.
"Security was completely breached, the server creator's account was hijacked, and all admins were banned, so we can't take action from our side," Meccha Chameleon creator Lemorion_1224 shared in an auto-translated X post over the weekend.
The news was also shared via an update on the game's Steam page, clarifying that the game itself wasn't a security risk, and could still be played safely as long as user-made maps weren't used. Still, things were looking rough--the hackers even put up a fake listing for a Meta Quest-compatible version of the game, which doesn't exist.
"Currently, a product called 'Meccha Chameleon VR' is available for preorder on the Meta Quest store, but we have not granted any production permission for it," Lemorion_1224 explained in an X post shared early this morning. "We are currently submitting a request for removal, so please refrain from purchasing it. We will not handle any monetary issues arising from counterfeit products."
But after a weekend of abject chaos, it seems things are finally stabilizing. A few hours after the announcement about the fake Meta Quest product listing, Lemorion_1224 revealed that a new update is now live for the game.
https://twitter.com/lemorion1224/status/2081710107214426595
Mini-update 3.3.1 replaces the Discord link on the game's title screen with a link to the correct server (which is now back in the possession of Mecca Chameleon creators Lemorion_1224 and Haganiero), fixes a physical collision issue, and perhaps most importantly, strengthens virus protection, though it's not clear if the issue with player-made map malware has been fully resolved for good.
For now, the safest bet is probably sticking to the game's default maps.
Meccha Chameleon–a multiplayer prop-hunt game that’s been blowing up on Steam lately–seems to have hit its first real road bump since it launched in early June. As pointed out by a player who goes by Feint, some of the game’s player-made maps are basically just Trojan horses containing malware. One of Feint’s friends had mentioned briefly seeing a command prompt appear while they were downloading the map. Curious, Feint dug into the files and concluded that the map known as Lazer Tag Zero contained a “malware dropper.”
The map was quickly pulled from Meccha Chameleon’s Steam Workshop page after Feint published their findings in a Medium article. But the chaos was just beginning. Other malware-filled maps started appearing, and then the game’s official Discord server was hacked.
“Security was completely breached, the server creator’s account was hijacked, and all admins were banned, so we can’t take action from our side,” Meccha Chameleon creator Lemorion_1224 shared in an auto-translated X post over the weekend.
The news was also shared via an update on the game’s Steam page, clarifying that the game itself wasn’t a security risk, and could still be played safely as long as user-made maps weren’t used. Still, things were looking rough–the hackers even put up a fake listing for a Meta Quest-compatible version of the game, which doesn’t exist.
“Currently, a product called ‘Meccha Chameleon VR’ is available for preorder on the Meta Quest store, but we have not granted any production permission for it,” Lemorion_1224 explained in an X post shared early this morning. “We are currently submitting a request for removal, so please refrain from purchasing it. We will not handle any monetary issues arising from counterfeit products.”
But after a weekend of abject chaos, it seems things are finally stabilizing. A few hours after the announcement about the fake Meta Quest product listing, Lemorion_1224 revealed that a new update is now live for the game.
Mini-update 3.3.1 replaces the Discord link on the game’s title screen with a link to the correct server (which is now back in the possession of Mecca Chameleon creators Lemorion_1224 and Haganiero), fixes a physical collision issue, and perhaps most importantly, strengthens virus protection, though it’s not clear if the issue with player-made map malware has been fully resolved for good.
For now, the safest bet is probably sticking to the game’s default maps.
