{"id":570012,"date":"2026-07-27T07:22:11","date_gmt":"2026-07-27T07:22:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/570012\/"},"modified":"2026-07-27T07:22:11","modified_gmt":"2026-07-27T07:22:11","slug":"steam-workshop-malware-exploited-meccha-chameleon-flaw-to-infect-players","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/570012\/","title":{"rendered":"Steam Workshop malware exploited MECCHA CHAMELEON flaw to infect players"},"content":{"rendered":"

\"\"<\/p>\n

A malicious Steam Workshop map for the indie game MECCHA CHAMELEON abused a vulnerability in the game’s mod-loading system to execute malware on players’ PCs.<\/p>\n

Following public disclosure, the developers released an update that fixes the issue, and Steam has removed the known malicious maps, although similar uploads continue to appear.<\/p>\n

The campaign was documented by independent reverse engineer Feint, who began investigating after multiple players reported a Command Prompt window briefly flashing while a Workshop map was loading. An analysis of the map<\/a>, originally published on July 23 and updated several times on July 25, traced the behavior to a malicious Unreal Engine Blueprint hidden inside the Workshop content.<\/p>\n

MECCHA CHAMELEON is a multiplayer game built on Unreal Engine 5 that supports user-created maps through the Steam Workshop.<\/p>\n

The original malicious map, \u201cLaser Tag Neon\u201d (Workshop ID 3765145606), appeared harmless at first glance, containing only standard Unreal Engine asset containers and metadata files. However, inspection of the assets revealed a Blueprint originally named BP_RCE_Test, later renamed to BP_AmbientController, that executed automatically when a match started.<\/p>\n

\"\"Feint<\/p>\n

According to Feint’s analysis, the Blueprint wrote a batch file named s.bat into the user’s Documents folder. The script then launched PowerShell with a bypassed execution policy, attempted to download a second-stage payload named steamb.bat from a hardcoded server, and executed it.<\/p>\n

Initially, the second-stage payload could not be recovered because the attacker’s server returned HTTP 404 errors. However, after recovering steamb.bat, Feint updated the report to confirm it installed a Remote Access Trojan (RAT), allowing attackers to remotely control compromised systems. This significantly raised the severity of the incident beyond an initial dropper.<\/p>\n

In June, Kaspersky disclosed<\/a> dozens of malicious Wallpaper Engine \u201capplication wallpapers\u201d uploaded to Steam Workshop that delivered infostealers, backdoors, ransomware, cryptocurrency miners, and other malware. Unlike the MECCHA CHAMELEON attack, which exploited a vulnerability in the game’s Workshop map-loading process, the Wallpaper Engine campaign abused the application’s legitimate ability to run executable wallpaper packages.<\/p>\n

The game\u2019s developers responded by releasing version 3.1.0, which fixes the vulnerability that allowed Workshop maps to trigger the malicious execution chain. Steam has also removed the identified malicious maps. One replacement map, \u201cChroma Grid Arena,\u201d briefly appeared before also being removed.<\/p>\n

According to International Cyber Digest, the malware also compromised a spare testing machine belonging to a MECCHA CHAMELEON system engineer, allowing attackers to hijack an administrator account on the game’s Discord server, bypass two-factor authentication, and remove staff members. The development team said the infected system had no access to the game’s source code and denied claims spread through the compromised Discord server that the latest game update itself contained malware.<\/p>\n

\u203c\ufe0f Hang in there, it gets worse: MECCHA CHAMELEON’s Discord server was taken over after malware infected a system engineer\u2019s PC and compromised an administrator account, allowing the attacker to bypass two-factor authentication and remove staff members from the server.<\/p>\n

Community\u2026 https:\/\/t.co\/QnMu6nMODE<\/a> pic.twitter.com\/3lsXSxbnIe<\/a><\/p>\n

\u2014 International Cyber Digest (@IntCyberDigest) July 25, 2026<\/a><\/p>\n

Users who launched the affected Workshop maps before installing version 3.1.0 are advised to run a full malware scan and inspect %USERPROFILE%\\Documents and %TEMP% for suspicious batch files. Researchers also recommend reviewing Windows Startup entries and Task Scheduler for unauthorized persistence mechanisms, updating the game, and downloading Workshop content only from established creators with active community feedback and open comments.<\/p>\n

If you liked this article, be sure to follow us on X\/Twitter<\/a> and also LinkedIn<\/a> for more exclusive content.<\/p>\n