The popular video game Meccha Chamelon fell victim to a cyberattack that allowed criminals to take control of many players’ computers. The root of the problem lay in community-created maps hosted on Steam Workshop, which contained hidden malicious code.

An independent researcher, Feint, discovered that maps like Laser Tag Neon executed background commands when loaded, installing a remote access trojan (RAT) on infected machines. This gave attackers full control over compromised systems. Feint advised players to run deep scans and delete suspicious .bat files.

Shortly after Feint went public with his findings, the infected map was removed, but others equally harmful appeared, such as Chroma Grid Arena. The game’s developers, lemorion_1224 and Haganeiro, released a security patch (version 3.1.0) to fix the vulnerability. However, during that process, one of their team members got infected, and the hacker seized the opportunity to take over the game’s official Discord server, which has 100,000 members, kicking out all staff and modifying permissions.

After the incident, the developers wiped the affected computer and, with Discord’s help, regained control of the channel and banned the intruders. They also released a new update (3.3.1) with reinforced anti-malware measures. Although they warned that the attacker might attempt new scams, they urged the community not to click on suspicious links or follow dubious instructions.

The exact number of affected users is unknown, but there are indications that the exploit had been active for some time. A Steam review from July 8 had already warned about similar security risks, though without official confirmation. This case adds to other recent precedents, such as the free game Beyond The Dark, which stole user data and cryptocurrencies, leading the FBI to open an investigation and set up a webpage to collect testimonies from victims.

ForAllTechNews