Meccha Chameleon malware scare: Workshop map exploit led to RAT infections and Discord server takeover
A serious security incident involving Meccha Chameleon has raised fresh concerns about how user-generated game content can be abused when mod-loading systems are not properly locked down. According to the investigation, the problem was not caused by the Steam Workshop platform itself, but by the way the game handled certain custom map assets.
The exploit allowed a malicious Workshop map to run hidden logic through the game’s own Unreal Engine 5 Blueprint system. Once triggered, that logic could write files to a player’s computer and start a chain of events that ultimately installed a Remote Access Trojan, also known as a RAT. This type of malware can give attackers remote control over an infected device.
The issue came to light after players noticed something unusual while loading a community-made map. A Command Prompt window reportedly appeared for a brief moment, which prompted deeper investigation. The suspicious map, known as Laser Tag Neon, was found to contain concealed Blueprint behavior that should not have been present in a normal custom arena. Another map, Chroma Grid Arena, later appeared briefly before it was also removed.
At the center of the attack was an Unreal Engine Blueprint originally named BP_RCE_Test, later disguised under the less suspicious name BP_AmbientController. When the infected map loaded, the Blueprint automatically ran through Unreal Engine’s BeginPlay event. Instead of handling ordinary in-game functions such as lighting, ambience, or level behavior, it created a file path and wrote a malicious file to the player’s system.
That file, named s.bat, was placed inside the victim’s Documents folder under the user profile directory. The file was designed as a JSON and batch-script polyglot, meaning it could appear like structured JSON data while also functioning as an executable Windows batch file when launched directly.
Once active, the script relaunched itself and used a hidden PowerShell process to bypass execution restrictions. It then reached out to a hardcoded command-and-control server to download another payload. That second-stage payload was later identified as a persistent Remote Access Trojan, giving attackers the ability to maintain access to compromised machines.
The situation became even more serious during the investigation. A spare test machine used by a system engineer to analyze the malware was also infected. Attackers reportedly used that compromised system to bypass two-factor authentication on an administrator’s Discord account. From there, they changed server permissions and banned official staff members from the game’s Discord community, which has close to 100,000 members.
The official Discord server was eventually recovered, but the incident shows how quickly a game-related malware campaign can spread beyond infected players’ PCs and into community management systems.
The Meccha Chameleon developers responded by releasing version 3.1.0, which patches the vulnerability and prevents Workshop maps from launching external processes. The malicious maps have also been removed. The development team stated that the game’s source code and production systems were not compromised.
Players who loaded custom maps before updating should take precautions immediately. A full antivirus or anti-malware scan is strongly recommended. Users should also check the Documents and TEMP folders for unfamiliar batch files, review Windows Task Scheduler for suspicious entries, and inspect startup programs for anything unusual. Updating Meccha Chameleon to version 3.1.0 or later is essential before loading any more custom content.
The Meccha Chameleon malware incident is an important reminder for both players and developers. Community-made content can be one of the best parts of PC gaming, but any system that allows custom assets to execute logic must be carefully sandboxed. Even when a platform’s review process is in place, a game’s internal handling of mods, maps, and scripts can become the weakest link if it allows external processes to run unchecked.
