A malicious Steam Workshop map for the indie game MECCHA CHAMELEON abused a vulnerability in the game's mod-loading system to execute malware on players' PCs.
Following public disclosure, the developers released an update that fixes the issue, and Steam has removed the known malicious maps, although similar uploads continue to appear.
The campaign was documented by independent reverse engineer Feint, who began investigating after multiple players reported a Command Prompt window briefly flashing while a Workshop map was loading. An analysis of the map, originally published on July 23 and updated several times on July 25, traced the behavior to a malicious Unreal Engine Blueprint hidden inside the Workshop content.
MECCHA CHAMELEON is a multiplayer game built on Unreal Engine 5 that supports user-created maps through the Steam Workshop.
The original malicious map, “Laser Tag Neon” (Workshop ID 3765145606), appeared harmless at first glance, containing only standard Unreal Engine asset containers and metadata files. However, inspection of the assets revealed a Blueprint originally named BP_RCE_Test, later renamed to BP_AmbientController, that executed automatically when a match started.
According to Feint's analysis, the Blueprint wrote a batch file named s.bat into the user's Documents folder. The script then launched PowerShell with a bypassed execution policy, attempted to download a second-stage payload named steamb.bat from a hardcoded server, and executed it.
Initially, the second-stage payload could not be recovered because the attacker's server returned HTTP 404 errors. However, after recovering steamb.bat, Feint updated the report to confirm it installed a Remote Access Trojan (RAT), allowing attackers to remotely control compromised systems. This significantly raised the severity of the incident beyond an initial dropper.
In June, Kaspersky disclosed dozens of malicious Wallpaper Engine “application wallpapers” uploaded to Steam Workshop that delivered infostealers, backdoors, ransomware, cryptocurrency miners, and other malware. Unlike the MECCHA CHAMELEON attack, which exploited a vulnerability in the game's Workshop map-loading process, the Wallpaper Engine campaign abused the application's legitimate ability to run executable wallpaper packages.
The game’s developers responded by releasing version 3.1.0, which fixes the vulnerability that allowed Workshop maps to trigger the malicious execution chain. Steam has also removed the identified malicious maps. One replacement map, “Chroma Grid Arena,” briefly appeared before also being removed.
According to International Cyber Digest, the malware also compromised a spare testing machine belonging to a MECCHA CHAMELEON system engineer, allowing attackers to hijack an administrator account on the game's Discord server, bypass two-factor authentication, and remove staff members. The development team said the infected system had no access to the game's source code and denied claims spread through the compromised Discord server that the latest game update itself contained malware.
Users who launched the affected Workshop maps before installing version 3.1.0 are advised to run a full malware scan and inspect %USERPROFILE%\Documents and %TEMP% for suspicious batch files. Researchers also recommend reviewing Windows Startup entries and Task Scheduler for unauthorized persistence mechanisms, updating the game, and downloading Workshop content only from established creators with active community feedback and open comments.
Leave a Reply