Malware Discovered in User Maps of Hit Game Meccha Chameleon

WHO:

Mashable - The developer of Meccha Chameleon is Lemorion_1224.

Eurogamer.net - An independent researcher known as Feint reported the malware issue.

WHAT:

Mashable - Malware was found hidden in user-created maps for the game Meccha Chameleon.

Eurogamer.net - The map "Laser Tag Neon" was identified as containing malware and was removed from the Steam Workshop.

Eurogamer.net - A second malware-infected map, "Chroma Grid Arena," was also reported and subsequently removed.

Eurogamer.net - Lemorion_1224 released a patch (version 3.1.0) to address the vulnerability that allowed the malware to execute.

WHERE:

Eurogamer.net - The malware was found in maps available on the Steam Workshop for Meccha Chameleon.

Eurogamer.net - The official Discord server for Meccha Chameleon was hacked.

WHEN:

Eurogamer.net - The initial report of the malware was published on a Thursday.

Eurogamer.net - A new patch (version 3.1.0) was released on Saturday.

WHY:

Eurogamer.net - The malware was embedded in user-created maps, which are available for download by anyone who owns the game.

Eurogamer.net - The hack of the Discord server was attributed to a compromised account of a single admin.

HOW:

Eurogamer.net - The malware was identified as a "malware dropper" after a user reported seeing a command prompt window during the download.

Eurogamer.net - The hacker bypassed the engineer's Discord Two-Factor Authentication (2FA) to take over server permissions.

(UPDATED July 27, 2026 19:32 UTC)

Malware has been discovered hidden in user-created maps for the game Meccha Chameleon, with the map "Laser Tag Neon" and another called "Chroma Grid Arena" both identified and removed from the Steam Workshop. The game's developer, Lemorion_1224, has since released a patch, version 3.1.0, to fix the vulnerability that allowed the malware to execute, while the official Discord server for the game was hacked due to a compromised admin account. The malware was classified as a "malware dropper" after a user reported seeing a command prompt window during the download, and the hacker managed to bypass the engineer's Two-Factor Authentication to gain server permissions.