Meccha Chameleon malware found in Steam Workshop maps
Players are being told to update Meccha Chameleon after malicious custom maps were found infecting PCs and a Discord server was hit.
By Bianca Rossi · Entertainment Editor
3 min read
Meccha Chameleon malware has been found hidden inside custom Steam Workshop maps, with players urged to update the indie game and avoid its original Discord server after infected downloads hit PCs, according to a Dexerto report.
The trouble surfaced after players noticed brief black windows appearing on their screens while loading custom maps, Dexerto reported. Independent researcher Feint investigated those complaints and traced the activity to a Workshop map called “Laser Tag Neon.”
According to Feint’s findings as reported by Dexerto, the map placed a hidden file on a player’s computer when the map was loaded. That file was believed to contact the internet and pull down a second, more dangerous piece of malware in the background.
Steam Workshop maps are user-made downloads for games that support Steam’s community content system. In this case, Dexerto reported that the risk involved custom Meccha Chameleon maps that players loaded and played in-game.
What should Meccha Chameleon players do now?
Players should update Meccha Chameleon and stay away from the original Discord server for the time being, according to the warnings reported by Dexerto. Co-developer Haganeiro said the flaw behind the map exploit was fixed in update 3.1.0.
Feint noted that downloading a bad map alone was not enough to trigger the infection, according to Dexerto. Players had to load and play the malicious map for the malware to run.
The first map, “Laser Tag Neon,” was removed, Dexerto reported. Another infected map, “Chroma Grid Arena,” later appeared in its place, according to the same report.
Feint later found that the follow-up malware gave attackers continued remote access to infected computers, Dexerto reported. Remote access malware can let an attacker control or use a compromised machine after the initial infection, depending on what the malicious software is designed to do.
Haganeiro said update 3.1.0 fixed the underlying security issue. The co-developer also said the malicious code on affected maps had been disabled even for players who had not yet installed the update, according to Dexerto.
How did the Discord server get hit?
The security mess did not stop with player maps. Dexerto reported that a systems engineer helping the developers investigate the malware had a backup computer infected.
Hackers then used that compromised machine to access the engineer’s Discord account, according to the report. Developer LEMORION said the attackers changed server permissions and banned staff members from the game’s official Discord server, which had roughly 100,000 members.
Dexerto also reported that the infected device did not have access to Meccha Chameleon source code, game files or Steam developer accounts. Claims that the hijacked Discord server had infected the official game build were disputed, according to the report.
A replacement community server has been set up while the studio waits for Discord’s support team to respond, Dexerto reported.
This story draws on original reporting from Mashable.