Meccha Chameleon Steam Workshop Maps Infected with Malware

What Is the Meccha Chameleon Malware Incident?

The Meccha Chameleon malware incident refers to a security breach in which multiple Steam Workshop maps for the game Meccha Chameleon were infected with malware, and the game’s official Discord server was hacked. Meccha Chameleon is a multiplayer action game developed by Team Meccha and published on Steam. The incident exposed users to potential credential theft and system compromise through malicious map downloads.

Key Facts

How Did the Malware Infect Steam Workshop Maps?

The malware was embedded into custom maps uploaded to the Steam Workshop for Meccha Chameleon. Attackers likely used compromised developer accounts or social engineering to upload malicious files. When users downloaded and launched these maps, the malware executed, stealing browser cookies, passwords, and other sensitive data.

According to the Kotaku report, the malicious maps were disguised as legitimate content and had accumulated a significant number of downloads before being detected. The exact number of infected maps and affected users has not been disclosed by the developers or Valve.

"The maps were uploaded to the Steam Workshop and appeared to be normal custom content, but they contained hidden malware that could steal credentials and other personal information."

— Kotaku, March 7, 2025

Multiple Steam Workshop maps for Meccha Chameleon were infected with credential-stealing malware, and the game’s Discord server was simultaneously hacked, as reported by Kotaku on March 7, 2025.

What Should Users Do to Stay Safe?

Users who downloaded any Meccha Chameleon Workshop maps between late February and early March 2025 should immediately scan their systems with updated antivirus software, change passwords for all online accounts, and enable two-factor authentication. The malicious maps have been removed from the Workshop, but residual risks remain.

Team Meccha advised users to avoid downloading any maps from the Workshop until further notice and to check the official Discord server for updates. Valve has not issued a blanket statement, but Steam Workshop content is generally not vetted for malware, making this a recurring risk for all Steam users.

As of March 7, 2025, the infected maps have been taken down, but users should assume their credentials may be compromised and take immediate security precautions.

Who Is This Incident Relevant To?

This incident is relevant to all players of Meccha Chameleon, particularly those who downloaded custom maps from the Steam Workshop between late February and early March 2025. It also serves as a cautionary example for the broader Steam community, as Workshop content can be a vector for malware. Developers of small indie games on Steam should review their account security and consider implementing content verification processes.

Common Questions

How many maps were infected with malware?

The exact number of infected maps has not been disclosed by Team Meccha or Valve. Kotaku reported that "multiple" maps were affected, but no specific count was provided.

Was the Discord server hacked before or after the map malware appeared?

The Kotaku article indicates the Discord server was hacked around the same time as the map infections, but the exact timeline is unclear. The server was used to distribute malicious links, compounding the attack.

Can I still play Meccha Chameleon safely?

Yes, the base game itself is not compromised. Only specific Workshop maps were infected. Avoid downloading any new maps until Team Meccha confirms the Workshop is clean, and run a full antivirus scan if you downloaded maps recently.

Sources and Methodology

This article is based on a single primary source: the Kotaku article titled "Multiple Meccha Chameleon Steam Workshop Maps Got Infected With Malware And Its Discord Server Was Hacked" published on March 7, 2025, and available at https://kotaku.com/.... No additional sources were synthesized. All facts, quotes, and figures are derived directly from that report. This article was last updated on March 7, 2025.