Meccha Chameleon Patch Adds Protections After Malware Found in Workshop Maps

A fast-growing Steam multiplayer prop-hunt game, Meccha Chameleon, ran into a serious community security problem after multiple player-made maps were found to include malware. The developer says the game itself remains safe to play, but it’s been temporarily risky to use Workshop maps—until a fresh patch adds additional protections.

What went wrong with Meccha Chameleon’s player-made maps

After the game launched in early June, concerns surfaced that some community-created maps were acting like delivery mechanisms for harmful software. A Steam user known as Feint investigated after a friend briefly saw a command prompt during a map download, then reported that a Workshop map called Lazer Tag Zero appeared to contain a “malware dropper.”

Once the findings were published, the map was removed from the Steam Workshop page. However, more malware-infected maps reportedly appeared afterward, and the situation escalated again when the game’s official Discord server was compromised.

How the Discord breach affected the response

The developer, Lemorion_1224, said the Discord security was “completely breached.” They added that the server creator’s account was hijacked and that all admins were banned, limiting what the team could do from their side.

What the developer says players should do (right now)

The studio clarified on Steam that Meccha Chameleon itself is not the security risk. The key concern is user-made maps.

• Play the game without using Workshop maps.
• Prefer the game’s default maps until the malware situation is fully resolved.

Fake Meta Quest listing warning

Alongside the malware and Discord issues, scammers also reportedly created a false store listing for a Meta Quest-compatible version of the game. The developer stated that “Meccha Chameleon VR” is not something they have authorized.

They said the item is showing as available for preorder on the Meta Quest store, but they have not granted production permission. The team also stated that they are submitting a request to remove the listing and asked players not to purchase it. They added they won’t handle monetary issues resulting from counterfeit products.

Patch 3.3.1: what’s changed

After announcing the fake listing issue early this morning, the developer later revealed that update 3.3.1 is now live. The mini-update includes three specific fixes:

1. Replaced the Discord URL on the game’s title screen with a link to the correct server.
2. Fixed a physical collision issue related to “Fukuyoka.”
3. Strengthened virus protection.

The developer also said the Discord server is back in the possession of the creators, including Lemorion_1224 and Haganiero. It’s not yet confirmed whether the malware behavior in player-made maps has been fully eliminated permanently, but the latest patch is aimed at improving protection.