A Steam Workshop Map Infected a Meccha Chameleon Engineer, Which Is How Attackers Took Over a 100K-Member Discord

Security researcher Feint found malicious code inside Meccha Chameleon maps published on Steam Workshop. The map "Laser Tag Neon," followed by a second one, "Chroma Grid Arena," wrote a .bat file to disk that used PowerShell to download and run a second, real payload: a remote access trojan and a crypto stealer. Developer Haganeiro patched the hole in update 3.1.0. The real mess was only getting started.

The real target of this attack was one infected computer that happened to have admin rights on a Discord server with 100,000 members. Discord itself was just collateral damage from that infection.

How it escalated

While the Meccha Chameleon team investigated Feint's report, one of their system engineers fell victim to the exact same mechanism. With access to that machine, the attacker found an active Discord session belonging to someone with server admin rights. Bypassing two-factor authentication from that point was a pure technicality. Discord as a platform had no vulnerability in this at all.

What happened on the hijacked server

With the admin account in hand, the attacker banned the entire official staff, seized permissions, and started pushing out fake announcements. They claimed the game's latest update itself contained a remote access trojan and that players had to follow specific steps to "fix" it. That was a second infection attempt, this time posing as the developer's own official channel.

Haganeiro responded publicly before regaining control of the main server: "Even if a hacker attempted to modify the game, Steam's developer infrastructure prevents anyone from publishing a game update simply by compromising a PC." The game itself, according to the developer, stayed safe throughout. The team stood up a backup community server while working to recover the original one, estimating the process at roughly 48 hours.

Why this matters beyond Meccha Chameleon's own players

This attack chain says something true about every game with a community workshop: player-made mods and maps are a full-fledged infection vector. Valve doesn't automatically scan workshop content for executable code run outside the game engine itself, so responsibility for that effectively falls on individual developers and on players staying alert.

The second layer of the problem is even more universal: "infected employee → hijacked Discord with admin rights → mass disinformation to users" doesn't require any flaw in Discord itself. It only requires one infected computer belonging to someone with the right permissions. That's the exact same mechanism that regularly hits Discord communities around other games and projects, regardless of how well-secured the platform itself is.

What to do if you played these maps

Update the game to 3.2.0 immediately. If you launched any of the suspicious maps before the patch, run a full system scan and check your Documents folder and temp directories for recently created .bat files. Since one of the payloads was a crypto stealer, it's also worth checking wallet activity if you keep any on the same machine. Avoid the game's original Discord server for now until full recovery is confirmed, don't click links from it, and don't follow any "fix steps" posted on channels whose status isn't verified.

SPAWNSY verdict