Fixes roll out after Meccha Chameleon servers infected with malware, Discord hacked

A vulnerability in Meccha Chameleon, which has already been patched, allowed multiple Steam Workshop maps to distribute malware to players.

As a post on Medium from user Feint discussed (via Kotaku), "A couple of my friends reported seeing a command prompt window briefly appear while Steam was downloading a custom workshop map … What I found was a seemingly ordinary workshop map that contained what appears to be a malware dropper, despite having passed workshop review." The full details regarding the map, Laser Tag Neon, are in the blog, though Feint updated the post to say another map called Chroma Grid Arena was uploaded in its place.

Meccha Chameleon developer Haganeiro confirmed the issue in a post on X Saturday, clarifying it has since been fixed. "The vulnerability in the custom maps described in today's update 3.1.0 has been fixed, so there are no issues after applying it," Haganeiro wrote. "We have also confirmed that the malware is disabled for the affected maps both before and after the update."

Details

As comments like one from X user Jeff reading "Your discord is fucked man" indicate, malicious custom maps weren't the only issue the devs encountered this past week. The game's official Discord server, which has nearly 100,000 users, was hacked. This was confirmed and addressed in a Steam Community blog post yesterday. "We have already contacted Discord Support and are currently awaiting their response," it reads. "If the server cannot be recovered, we will set up a new one."

Developer lemorion_1224 confirmed in a post on X that this happened because a system engineer's PC was infected with malware while fixing the aforementioned vulnerabilities: "The hacker bypassed the engineer’s two-factor authentication on Discord, altered the server permissions, and banned all the staff members." The affected PC, a backup device, was wiped and can't be used to edit game files, but lemorion_1224 warned players not to follow any "suspicious links" on the compromised Discord.