Meccha Chameleon hit by malware-spreading Workshop maps and Discord hack

Meccha Chameleon had a rough week — a vulnerability in the game let malicious Steam Workshop maps push malware onto players' machines, and the game's official Discord server was hacked on top of that. Developer Haganeiro confirmed both issues and says the core vulnerability has been patched.

The malware discovery came from a Medium post by a user called Feint, who noticed a command prompt window flashing during a Workshop map download. Digging in, Feint found a map called Laser Tag Neon that contained what looked like a malware dropper — despite having passed Steam's Workshop review process. A second map, Chroma Grid Arena, was later uploaded in its place. Haganeiro addressed the vulnerability in update 3.1.0, writing on X that the fix is live and that the malware has been confirmed disabled on the affected maps both before and after the patch. The Discord hack came to light through user comments on X — one simply read "Your discord is fucked man" — and was later confirmed in an official Steam Community blog post. The server has nearly 100,000 members. Developer lemorion_1224 explained on X that a system engineer's PC was infected with malware while the team was working to fix the Workshop vulnerability. The hacker used that foothold to bypass the engineer's two-factor authentication on Discord, changed server permissions, and banned all staff members. The compromised PC — described as a backup device — has been wiped and can no longer access game files. Haganeiro says it has contacted Discord Support and is waiting on a response; if the server can't be recovered, the team will create a new one.

Meccha Chameleon is a relatively small indie title, but the incident highlights a real risk in user-generated content pipelines — malicious files can slip through automated review and reach players before anyone catches them. The fact that the Discord breach happened while the team was actively responding to the first crisis made a bad week considerably worse.

For now, Haganeiro is urging players not to click any suspicious links posted in the compromised Discord server while recovery efforts continue. Update 3.1.0 is the fix to apply if you haven't already.