Security Researcher Detects Malware in MECCHA CHAMELEON Map

Security researcher Feint recently uncovered malicious code hidden inside a user-created MECCHA CHAMELEON Steam Workshop map titled "Laser Tag Neon." The map utilized a disguised Unreal Engine Blueprint to execute a batch file (`s.bat`) in the Windows Documents directory. Upon loading, the file opened a covert PowerShell window designed to retrieve a secondary payload from a remote server.

Although Valve removed the affected map, researchers could not identify the full payload because the download server returned a 404 error. Players report similar suspicious custom maps appearing under altered titles, though Valve has not issued a formal public response.

PC players who downloaded custom maps should unsubscribe from unverified Workshop items, perform a system antivirus scan, and verify game file integrity via Steam. macOS and Steam Deck users remain unaffected.