Meccha Chameleon, the breakout indie hit of 2026 with over 15 million copies sold on Steam, is currently managing a series of security breaches affecting both its community workshop and its official social channels.

Malware in Steam Workshop Maps

Security concerns began on July 24, 2026, when an independent researcher known as Feint reported that custom maps on the game's Steam Workshop were distributing malware. The report highlighted a specific map titled "Laser Tag Neon," which, despite passing initial moderation, would trigger a command prompt window to execute a malicious script upon being loaded.

According to the International Cyber Digest, the script wrote a Windows command file to the user's documents folder, which then leveraged an invisible PowerShell window to download additional malicious payloads. While the "Laser Tag Neon" map was quickly removed, the researcher noted that new malicious files were briefly uploaded to replace it.

Developer lemorion_1224 confirmed in a statement that they have addressed the underlying vulnerability with the release of the version 3.1.0 update. Players are encouraged to ensure their game is fully updated to the latest version.

Official Discord Server Compromised

Alongside the workshop issues, the development team announced that the official Meccha Chameleon Discord server has been hacked. The incident reportedly stems from the same security breach that introduced the workshop malware: a system engineer’s PC was infected, allowing the attacker to bypass two-factor authentication.

The developer stated that the hackers altered server permissions and banned all staff members, leaving the team currently unable to manage the channel. They have contacted Discord support and are awaiting a resolution. If the original server cannot be recovered, the team plans to establish a new official community space.

Quick Facts

  • Game: Meccha Chameleon
  • Platform: PC (Steam)
  • Security Update: Version 3.1.0 patch addresses the Workshop malware vulnerability.
  • Discord Status: Official server currently compromised; developers are awaiting support from Discord.
  • Root Cause: Malware infection on an engineer's PC led to unauthorized account access and server takeover.