Meccha Chameleon Discord Server Hijacked After Steam Workshop Malware Incident

The compromise removed official staff from the community server and turned a trusted communication channel into a potential vehicle for phishing and malicious links.

Incident status: Restored | Incident window: July 25–26, 2026 | Attribution: Unknown

Meccha Chameleon is a popular multiplayer hide-and-seek game on Steam in which players paint their characters to blend into their surroundings just like a chameleon.

Meccha Chameleon’s official Discord server was hijacked on July 25, 2026, after malware reportedly infected a system engineer’s computer while the development team was investigating malicious Steam Workshop content. According to the developers, the attacker gained access to an administrator’s Discord account, changed server permissions, and banned official staff members.

The team warned players not to trust announcements, follow instructions, or click links posted in the compromised server. The game’s files and production systems were not reported as affected. An official Steam announcement dated July 26 later confirmed that the Discord server had been restored and the attackers removed.

Incident at a Glance

What Happened to the Meccha Chameleon Discord Server?

The Discord takeover unfolded alongside a malware campaign involving malicious community maps distributed through Steam Workshop. Researcher Feint initially identified a map called Laser Tag Neon that used an Unreal Engine Blueprint to write a batch file to the player’s Documents folder when the map loaded. The script launched PowerShell in a hidden window, downloaded a second-stage payload from an external server, and attempted to execute it.

The second-stage payload was initially unavailable because the attacker’s server returned an HTTP 404 response. It was later recovered and analyzed, revealing that it installed a Remote Access Trojan (RAT) capable of giving the attacker remote control over affected systems. This technical finding makes remote-access reports plausible, although individual community claims cannot be independently linked to the malware without forensic evidence.

Malicious Workshop Maps Delivered a RAT

After Laser Tag Neon was removed, the researcher identified another malicious map named Chroma Grid Arena. By the afternoon of July 25, the developers had released version 3.1.0, and all identified malicious maps were reportedly removed from Steam Workshop.

According to the researcher, the malware executed when an affected map was loaded for a match, not simply when a user subscribed to it. Players who subscribed but never launched the map were not exposed through the documented execution chain.

How Did the Malicious Workshop Maps Execute Code?

Meccha Chameleon’s custom maps could contain Unreal Engine 5 Blueprint logic, which runs automatically through the BeginPlay event when a map loads. Laser Tag Neon concealed its malicious behavior inside a Blueprint named BP_AmbientController, which retained the earlier internal name BP_RCE_Test.

When the map loaded, the Blueprint used the game’s file-writing functionality to create s.bat in the player’s Documents folder. Its contents were constructed as a JSON and batch-file polyglot, allowing the data to pass through a JSON-writing function while remaining executable as a Windows batch script.

The batch file relaunched itself in a minimized window and started PowerShell with a hidden window and process-level execution-policy bypass. It then contacted a hardcoded external server, downloaded another batch file to the Windows temporary directory, and executed it. Researchers later determined that this second-stage payload installed a RAT.

Earlier research had demonstrated another remote code execution path involving unrestricted Workshop files and Unreal Engine’s LaunchURL function. The developers initially restricted the file types accepted through Workshop, but arbitrary file-writing through Blueprint logic could bypass that mitigation.

How Did the Developers Respond?

The developers released version 3.1.0 to address the mod-loading weakness. They later said that a system engineer’s spare testing computer became infected while the team was investigating and patching the malicious map issue. The infected computer reportedly had no access to the game’s source code, and the team said it was wiped and reformatted.

The developers later stated in the version 3.2.0 release notes that the Workshop vulnerability had been resolved in the previous update. According to the announcement, Steam Support also confirmed that the patched version could no longer execute unrelated files such as malware.

Were Players Remotely Controlled?

Community reports also reflected the concern surrounding the incident. In one Steam discussion, a player claimed that their computer began behaving as though it was being remotely controlled after playing the game. The report has not been independently verified, so it does not establish that the user was affected by the malicious Workshop content. However, it illustrates the confusion and potential impact reported by players during the incident.

The developers described the Discord compromise as being limited to one administrator account. Once inside, the attacker reportedly changed permissions and removed or banned staff, leaving the team unable to moderate the server or control its announcements.

How the Incident Unfolded

• July 23: Feint began documenting the malicious Laser Tag Neon Workshop map and its batch-file delivery chain.
• July 24: The researcher publicly disclosed the findings.
• July 25: Laser Tag Neon was removed, but another malicious map named Chroma Grid Arena was identified.
• July 25: The developers released version 3.1.0 to prevent malicious Workshop maps from executing malware.
• July 25: The development team announced that its official Discord server had been hijacked after malware infected a system engineer’s computer.
• July 25: The recovered second-stage payload was analyzed and identified as a RAT capable of remote system control.
• July 26: Version 3.2.0 release notes stated that the vulnerability had been resolved and that Steam Support had confirmed unrelated files such as malware could no longer be executed.
• July 26: The developers announced that the Discord server had been restored and the attackers banned. Some coverage reported the recovery on July 27, explaining the difference between published dates.

Was Discord’s Two-Factor Authentication Bypassed?

The developers said the attacker “bypassed” the engineer’s two-factor authentication, but no technical explanation or forensic evidence has been published. The wording should therefore not be interpreted as confirmation of a vulnerability in Discord’s MFA system.

Malware on an already authenticated endpoint can enable account takeover without defeating MFA cryptographically. Possible methods include stealing a Discord session token or browser cookie, abusing an authorized OAuth application, remotely controlling an active session, or capturing credentials and authentication artifacts. The exact mechanism remains unknown.

What Was Affected?

The confirmed operational impact centered on the Discord server and its role as an official communications channel. Public reporting does not establish that Discord itself, Steam’s core platform, or Meccha Chameleon’s production environment was compromised.

• Administrative control: Attackers reportedly changed roles and permissions and removed official staff.
• Community communications: Announcements and other trusted server channels could no longer be treated as authoritative.
• User exposure: Members faced an elevated risk of phishing, fake support messages, malicious downloads, and invitations to impersonator servers.
• Data exposure: No public evidence currently confirms that member data was stolen or offered for sale.

What Should Players and Server Administrators Do?

Guidance for Players

• Treat links, downloads, verification requests, and support instructions posted during the takeover as untrusted unless they are confirmed through an independent official channel.
• If you opened a link or ran a file shared through the server, disconnect the affected device if suspicious activity is present, run a trusted malware scan, and review important accounts for unauthorized access.
• Change exposed passwords, revoke active Discord sessions, inspect authorized applications, and confirm that MFA remains correctly configured.
• Check %USERPROFILE%Documents and %TEMP% for suspicious or recently created .bat files.
• Review Windows startup entries and Task Scheduler for unfamiliar persistence mechanisms.
• Players who launched Workshop maps before installing version 3.1.0 should perform a full endpoint scan.
• If compromise is suspected, reset important credentials from a separate clean device and revoke active sessions for Discord, Steam, email, and other sensitive accounts.
• Use the official Steam page or another verified channel to confirm server invitations and recovery announcements.

Guidance for Discord Server Owners

• Revoke active sessions and OAuth authorizations for affected administrator accounts, not only their passwords.
• Review the Discord Audit Log for role changes, webhook creation, bot additions, channel modifications, bans, and altered invite links.
• Remove unauthorized integrations and rotate secrets used by bots, webhooks, or connected services.
• Limit the number of full administrators and use scoped roles for routine moderation.
• Use dedicated administrative identities or devices that are separated from development testing, mod analysis, and general browsing.
• Maintain an out-of-band announcement channel and a documented server-recovery process.

How SOCRadar Can Help Monitor Follow-On Risk

Although attribution remains unknown, researchers published technical indicators associated with the malicious Workshop map and its download infrastructure. Security teams can use these indicators to search endpoint, DNS, proxy, and network telemetry for possible exposure.

SOCRadar Digital Risk Protection can help identify lookalike domains, fake community accounts, and impersonation activity that may emerge after a trusted server is hijacked. Dark Web Monitoring can also surface alleged access-sale posts, exposed credentials, or underground discussions referencing the brand. Any findings should be validated before they are connected to the incident.

Indicators of Compromise

Researchers published the following indicators associated with the Laser Tag Neon map:

• Workshop item: 3765145606
• Malicious map: Laser Tag Neon
• Dropped file: %USERPROFILE%Documentss.bat
• Second-stage file: %TEMP%s.bat
• Download server: 31[.]57[.]34[.]228
• Payload URL: hxxp://31[.]57[.]34[.]228/work/steamb[.]bat
• SHA-256: 1ff540bc3c493a93059e602b414ba61027ed1a2b8a079f6197b0718f4a2101b6
• MD5: 04d6dfadd5248c995951707e27520ade

Conclusion

The Meccha Chameleon incident shows how an infected staff endpoint can undermine a trusted community channel even when the core product environment remains separate. For organizations that rely on Discord or similar platforms, endpoint protection, session revocation, least-privilege administration, configuration auditing, and alternative communication channels are essential parts of recovery.