Meccha Chameleon, the biggest Steam indie hit of 2026 by quite a large margin, has reportedly already sold over 15 million copies. Unfortunately, some of those 15 million players may want to run a virus scan at some point in the immediate future, as the developers behind the game have confirmed an independent report that stated malware has been distributed through multiple Meccha Chameleon Steam Workshop maps.
Last night on July 24, an independent researcher by the name of Feint published a report on Medium outlining how, “despite having passed workshop review,” a community map on Meccha Chameleon’s Steam Workshop, named Laser Tag Neon, would briefly open a “command prompt window” and begin downloading a script to install malware on users’ PCs.
‼️ Steam is hosting malware again, this time in a custom map for the game MECCHA CHAMELEON
Loading the map quietly writes a Windows command file into the player’s Documents folder, which then opens PowerShell in an invisible window and tries to download a second script from a… pic.twitter.com/96oK7T8Xxx
— International Cyber Digest (@IntCyberDigest) July 25, 2026
While the Laser Tag Neon map in question was swiftly removed following Feint’s report, the researcher later confirmed to International Cyber Digest on X that “new malicious maps” had been uploaded in its place. However, the development team behind Meccha Chameleon, lemorion_1224, noted in a statement that the vulnerability has been patched out following the release of today’s version 3.1.0 update.
Unfortunately, it seems the dev team has run into a completely separate hacking-related issue today, as a new post just went live on Meccha Chameleon’s Steam page announcing that the game’s official Discord server has been hacked.
“The game itself is not affected. Currently, the official MECCHA CHAMELEON Discord server has been hacked, and we are completely unable to take any action on our end,” reads the statement. “We have already contacted Discord Support and are currently awaiting their response. If the server cannot be recovered, we will set up a new one.”
The devs also confirmed in a separate statement on X that “while fixing the issue of malware embedded in a MOD map, a system engineer’s PC got infected with malware.” According to lemorion_1224, “the hacker bypassed the engineer’s two-factor authentication on Discord, altered the server permissions, and banned all the staff members,” so, at this point, it sounds like there’s very little hope of reclaiming the original Meccha Chameleon Discord server.