Two days ago, Reddit user FeintBe discovered that several custom Meccha Chameleon maps on the Steam Workshop were hosting malware delivery chains. They posted an extensive breakdown of their findings to Medium, prompting an investigation from developer Lemorion, which soon spiraled into a Discord breach as the team found themselves the victim to those same bad faith actors.
“The game itself is not affected,” Lemorion posted to Steam yesterday. “Currently, the official Meccha Chameleon Discord server has been hacked, and we are completely unable to take any action on our end. We have already contacted Discord Support and are currently awaiting their response. If the server cannot be recovered, we will set up a new one.”
With control firmly in the hands of the hacker, false statements were issued on the server claiming that the latest update contained a remote access trojan and that users must complete specific steps to fix it. “We have never implemented anything of the sort,” Lemorion clarified. “This statement was made solely to cause panic and mislead players. Even if a hacker attempted to modify the game, Steam’s developer infrastructure prevents anyone from publishing a game update simply by compromising a PC.”
Meccha Chameleon Dev Assures That It Is Now “Impossible To Execute” Malware
So, how did we go from a Reddit expose on Workshop maps to a Discord breach that left the developers scrambling to squash panic spread by a hacker?
“We now have a full picture of the situation,” Lemorion explained last night. “While investigating and patching a malicious mod map issue, a system engineer’s PC was infected with malware. The hacker bypassed the engineer’s Discord 2-Factor Authentication (2FA), took over server permissions, and banned all official staff members from the server. The infected PC was a spare testing machine, and it is physically impossible to access or edit game source files from it (which we have re-confirmed via logs). The affected PC has already been completely wiped and reformatted.”
In so many words, the team were made aware of the malicious maps on the Steam Workshop, decided to investigate, and fell victim, losing access to the Discord server. Lemorion urges the community not to click any links, join any external servers, or follow instructions.
A more promising development came earlier today with the release of update 3.2.0, when Lemorion announced that the issue had been resolved, and that it is now “impossible to execute unrelated files such as malware,” as confirmed by Steam Support. Lemorion assures that “the game itself is 100% SAFE and virus-free,” but Feint warned in an update to their blog post that you should only download popular Workshop maps with an established player base, and always check if the uploader is a brand-new Steam account or has disabled comments.
- Released
-
June 10, 2026
- Developer(s)
-
lemorion_1224
- Publisher(s)
-
lemorion_1224
- Multiplayer
-
Online Multiplayer
- Number of Players
-
2-10 players
