Steam Workshop was conceived as a platform for users to create and share content for games and applications on Steam. Unfortunately, it can also serve as a way for malicious actors to distribute malware to unsuspecting players, which is what happened to indie game Meccha Chameleon over the weekend. A vulnerability, which has since been patched, allowed users to download malware disguised as custom maps.
The issue was initially discovered by an independent researcher going by the username Feint. As outlined in their blog post on Medium, the researcher decided to investigate a custom map called Laser Tag Neon following reports of command prompt windows briefly appearing as it was being downloaded.
As it turned out, the map was a malware dropper that executed malicious code when players loaded it in a match. The map was later removed, although a new one called Chroma Grid Arena soon took its place. Meanwhile, further investigation revealed that the code served to retrieve and install a Remote Access Trojan, allowing attackers remote control of infected devices.
Following the discovery of the malware, Meccha Chameleon developer Haganeiro rolled out update 3.1.0, which fixed the vulnerability. Haganeiro also confirmed that the malware is “disabled for the affected maps both before and after the update”.
However, that was not the end of the game’s woes. While the developers were working to resolve the malware issue, the official Discord server was hijacked. According to an X post by developer Lemorion, this occurred because a system engineer’s PC was infected with malware while dealing with the vulnerabilities. Apparently, the attacker bypassed the engineer’s two-factor authentication on Discord and altered the server permissions before banning all staff members. The attacker then spammed the server with offensive messages and fake announcements.
Fortunately, the developers managed to regain control of the server after contacting Discord. As of the latest update, all known issues relating to the malware and subsequent hack have been resolved. Furthermore, the developers have asserted that the game itself remains safe to play, as the infected PC was a “spare testing machine” that was not used to edit game files.
Regardless, if you’ve been playing the game recently, especially with custom maps, you should probably run a malware scan to make sure everything is in order. Naturally, it’s a good idea to be mindful when downloading custom content.
(Source: Feint via Medium, Haganeiro via X, Lemorion via X [1], [2])
