Meccha Chameleon–a multiplayer prop-hunt game that’s been blowing up on Steam lately–seems to have hit its first real road bump since it launched in early June. As pointed out by a player who goes by Feint, some of the game’s player-made maps are basically just Trojan horses containing malware. One of Feint’s friends had mentioned briefly seeing a command prompt appear while they were downloading the map. Curious, Feint dug into the files and concluded that the map known as Lazer Tag Zero contained a « malware dropper. »
The map was quickly pulled from Meccha Chameleon’s Steam Workshop page after Feint published their findings in a Medium article. But the chaos was just beginning. Other malware-filled maps started appearing, and then the game’s official Discord server was hacked.
« Security was completely breached, the server creator’s account was hijacked, and all admins were banned, so we can’t take action from our side, » Meccha Chameleon creator Lemorion_1224 shared in an auto-translated X post over the weekend.
The news was also shared via an update on the game’s Steam page, clarifying that the game itself wasn’t a security risk, and could still be played safely as long as user-made maps weren’t used. Still, things were looking rough–the hackers even put up a fake listing for a Meta Quest-compatible version of the game, which doesn’t exist.
« Currently, a product called ‘Meccha Chameleon VR’ is available for preorder on the Meta Quest store, but we have not granted any production permission for it, » Lemorion_1224 explained in an X post shared early this morning. « We are currently submitting a request for removal, so please refrain from purchasing it. We will not handle any monetary issues arising from counterfeit products. »
But after a weekend of abject chaos, it seems things are finally stabilizing. A few hours after the announcement about the fake Meta Quest product listing, Lemorion_1224 revealed that a new update is now live for the game.
Mini-update 3.3.1 replaces the Discord link on the game’s title screen with a link to the correct server (which is now back in the possession of Mecca Chameleon creators Lemorion_1224 and Haganiero), fixes a physical collision issue, and perhaps most importantly, strengthens virus protection, though it’s not clear if the issue with player-made map malware has been fully resolved for good.
For now, the safest bet is probably sticking to the game’s default maps.
About The Author
