It seems like everyone these days is playing the insanely popular indie game Meccha Chameleon on PC, my friends included. If you’ve also played, you’re going to want to double-check what custom, user-created maps you’ve downloaded from the Steam Workshop.
Worse, if you’ve already downloaded some custom maps for the game, I strongly suggest you A) finish reading about the issue, and B) check your Steam library.
A security researcher who goes by Feint on Medium.com recently posted a lengthy analysis breaking down their findings. They posit that some workshop maps associated with Meccha Chameleon are quietly being rigged to drop malicious scripts (aka malware) onto players’ PCs.
Feint began the investigation after friends noticed a command prompt window flashing briefly as Steam downloaded a custom workshop map for the game. These downloads are handled automatically as you load into certain game lobbies.
On the surface, the custom map’s files looked totally normal, with standard Unreal Engine 5 asset containers and a lack of evident executables or scripts.
Digging deeper, however, Feint discovered the real problem: a Blueprint actor with a naming mismatch buried inside the map’s metadata. It was built to look like an ambient controller, but an outdated internal name tipped off the researcher.
According to Feint, the Blueprint is built to run automatically the moment the map loads. When it does, it injects a batch file into the gamer’s Documents folder on their Windows PC. Not good.
Once triggered, the batch file sneakily launches a hidden PowerShell process with bypassed execution policy before calling out to an outside server to download a second script.
Feint’s testing resulted in that download failing, so it remains unclear what exactly was intended to be sent to infected PCs.
No name for the malware, but a map shouldn’t act like this
Although the final goal of the odd script is debatable, a game’s map should never involve writing and executing scripts outside of the game’s folder. This is a clear sign of malware.
Feint also notes that there are some red flags surrounding the account that uploaded the map to Steam Workshop. The Steam account is only about a week old and has comments/ratings disabled on the listing, making it much harder for savvy victims to share their woes.
The malware-infused map has been reported to Steam, though it’s unclear whether any actions have been taken yet.
What you should do if you’ve downloaded Meccha Chameleon Workshop maps
Until Valve confirms that the map is malicious and pulls it from the Workshop library, your best bet is to avoid any new Meccha Chameleon maps, especially if they lack reviews and/or have comments disabled.
If you’ve downloaded custom maps recently, it’s probably worth running a PC scan with your favorite antivirus. You can also check your Documents folder for any strange .bat files hanging around.
To be clear, this isn’t the fault of the developers. Rather, this is another bit of potential malware that slipped past Steam’s Workshop screening process.
Just last month, Steam’s most popular PC background app, Wallpaper Engine, was discovered to be infecting users with malware. Valve, owner of Steam, took the necessary steps to remove the infected files, but added that this sort of thing could inadvertently happen again.
Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.
