The hugely popular indie game Meccha Chameleon is at the center of a security alert. Security researcher Feint discovered that custom maps downloaded from the Steam Workshop contain malicious scripts capable of infecting players' computers. Here is what happened and how to stay safe.
Researcher Feint's discovery
Feint, publishing a detailed analysis on Medium, explained that the investigation began after friends noticed a command prompt window flashing briefly while Steam automatically downloaded a custom map. At first glance, the map files looked normal: standard Unreal Engine 5 asset containers with no obvious executables. However, digging deeper, Feint identified a Blueprint actor with an outdated internal name, disguised as an ambient controller. This Blueprint activates automatically when the map loads and injects a batch file into the user's Documents folder on Windows. The batch file then launches a hidden PowerShell process with bypassed execution policy, contacting an external server to download a second script. In Feint's test, the download failed, so the final goal of the malware remains unclear.
Sponsored Protocol
An invisible threat
The fact that a game map executes scripts outside its own folder is a clear sign of malware. Feint also noted that the Steam account that uploaded the map was only a week old and had comments and ratings disabled, preventing victims from reporting the issue. The infected map has been reported to Valve, but it is unclear whether it has been removed yet. This incident follows a similar case last month where Wallpaper Engine, a popular Steam app, was used to spread malware. Valve removed the infected files but warned that such incidents could happen again.
Sponsored Protocol
How to protect yourself
Until Valve confirms the removal of the malicious map, it is best to avoid downloading new Meccha Chameleon maps from the Workshop, especially those lacking reviews or with comments disabled. If you have already downloaded custom maps, run a PC scan with your antivirus and check your Documents folder for any suspicious .bat files. Remember, this is not the fault of the game's developers, but rather a gap in Steam's screening process. For more on software security, read our article on Google requiring Android 7.0 for Play Services. To understand Steam Workshop better, see the Wikipedia entry.
Source: https://www.windowscentral.com/gaming/pc-gaming/meccha-chameleon-steam-workshop-malware
