Meccha Chameleon developers confirmed on July 25, 2026, that their official Discord server was compromised after a system engineer’s PC was infected with malware. While hackers attempted to spread panic by claiming a recent game update contained a Remote Access Trojan (RAT), the developers maintain the game itself remains 100% safe and virus-free.
The incident unfolded as a chaotic sequence of security breaches, beginning with a targeted attack on a developer’s hardware and escalating into a community-wide misinformation campaign. The breach allowed an attacker to bypass two-factor authentication (2FA) on a single admin account’s Discord, leading to the banning of official staff and the posting of obscene messages within the server.
The Steam Workshop Malware Exploit
The Discord hack followed a separate, more technical threat involving user-created content. A security researcher known as Feint reported that certain custom workshop maps were rigged to drop malicious scripts onto players’ computers. This exploit was triggered automatically as players loaded into specific game lobbies.
According to the analysis, the malware used a Blueprint actor with a naming mismatch hidden in the map’s metadata to appear as an ambient controller. Once the map loaded, it injected a batch file into the Windows Documents folder, which then launched a hidden PowerShell process to download a second script from an external server.
The researcher identified several red flags regarding the source of these maps, noting that the Steam account responsible for the uploads was only about a week old and had disabled comments and ratings to prevent victims from warning others.
Discord Compromise and the 3.1.0 Patch
The tension peaked on July 25, 2026, the same day the developers released Patch 3.1.0. This update was specifically designed as a security update to combat the exploit that allowed malware to be embedded in custom levels. However, the timing coincided with the Discord breach, creating a window for the hacker to sow confusion.
Once the hacker seized control of the Discord server, they began circulating claims that the very patch meant to fix the security issues was actually dangerous. The developers were forced to issue a direct contradiction via Steam to stop the spread of these claims.
“There are no viruses or malware embedded in the game itself. Claims made by the hacker who compromised our Discord—stating that “the latest update contains a RAT (Remote Access Trojan) and you must follow specific steps to fix it”—are 100% FALSE.”
Meccha Chameleon Developer, via keengamer.com
The developers clarified that the breach was limited to the social layer. Because the game and Discord are not integrated, the compromise of the server could not affect the game’s binary files. They further noted that Steam’s developer infrastructure prevents anyone from publishing a game update simply by compromising a single PC.
Recovery and Player Protection
The infected machine—described as a system engineer’s PC
—was a spare testing machine that has since been wiped and reformatted. The developers emphasized that it was physically impossible to access or edit game source files from that specific device.
- Avoid Unverified Maps: Steer clear of new Workshop maps that lack reviews or have comments disabled.
- Manual Inspection: Check the Windows Documents folder for any suspicious
.batfiles. - System Scans: Run a full antivirus scan if custom maps were downloaded recently.
- Discord Caution: Do not click links or follow instructions posted in the official Discord until the developers regain full control.
This incident highlights a recurring vulnerability in the Steam Workshop ecosystem, where user-generated content can bypass standard screening. The developers’ struggle to regain the Discord server underscores the danger of social engineering and 2FA bypasses, even when the core product remains secure.
While the 3.1.0 patch addresses the known exploit in custom levels, the primary uncertainty remains the identity and intent of the attacker who managed to breach the admin account. Until the developers fully recover their official communication channels, players remain reliant on Steam announcements to distinguish legitimate updates from hacker-led misinformation.
Worth a look
