Steam Workshop Malware Spreads Through Meccha Chameleon Maps — Here’s How to Stay Safe

The Discovery: A Hidden Payload in Plain Sight

The indie hit Meccha Chameleon has taken over PC gaming, but a newly uncovered threat is turning its Steam Workshop into an attack vector. Security researcher Feint, who published a detailed breakdown on Medium, found that at least one community-created map contains a malicious Blueprint actor designed to silently execute code on your system.

The investigation began when players noticed a command prompt window flash open briefly while Steam automatically downloaded a custom map for a lobby. Because Meccha Chameleon pulls Workshop assets directly into the game session, those downloads happen without an explicit permission prompt. On the surface, the map files appeared completely legitimate, using standard Unreal Engine 5 asset containers with no visible executables or scripts.

A close-up of a glowing computer monitor displaying a file directory tree with one highlighted folder marked by a red wa — Checking your Documents folder for suspicious batch files.

Feint dug into the map’s metadata and found the culprit: a Blueprint actor with a naming mismatch. It was disguised to look like an ambient controller, but an outdated internal identifier gave it away. Once the map loads, the Blueprint triggers automatically, writing a batch file directly into your Windows Documents folder. That batch file then launches a hidden PowerShell process with the execution policy bypassed, reaching out to an external server to pull a secondary script.

In Feint’s testing, the external download failed, leaving the final payload unknown. Regardless of the intended end goal, any map that writes and executes scripts outside the game directory is operating with clear malware behavior.

How the Infection Chain Works

The attack relies on a chain of quiet, automated steps that make it difficult to spot until it is too late. The Steam Workshop handles the initial delivery, but the actual execution happens locally the moment you join a lobby hosting the infected map.

Step 1: Steam auto-downloads the Workshop map when you enter a matching lobby.
Step 2: A disguised Blueprint actor fires on load, dropping a .bat file into your Documents folder.
Step 3: The batch file silently launches PowerShell with execution policy bypassed.
Step 4: PowerShell contacts an external server to download a second-stage script.

The Steam account that uploaded the map is only about a week old, and the listing has comments and ratings disabled. Those restrictions make it significantly harder for other players to flag the issue or share warnings before the map spreads further.

Steam Workshop moderation faces an ongoing arms race.

Valve has been notified, and the map has been reported through the standard Steam Workshop reporting flow. It remains unclear whether Valve has removed the listing or taken additional account-level action.

What This Means for You

If you own Meccha Chameleon and regularly browse the Steam Workshop, your system may already be exposed. The threat is not coming from the game’s developers; it is slipping past Steam’s automated Workshop screening process. This mirrors a pattern we have seen before, including the Wallpaper Engine Workshop incident last month, where community content was weaponized to distribute malware.

Steam’s auto-download feature is convenient, but it also means you are trusting unverified user content to run on your machine. Any Workshop item that attempts to write files outside its own directory, launch system commands, or reach out to unknown servers should be treated as hostile, regardless of how polished the in-game assets look.

What to Do Right Now

Until Valve confirms the map is malicious and removes it from the Workshop library, take these steps to secure your PC:

Stop using new Meccha Chameleon Workshop maps. Stick to the default maps or content from verified, long-standing creators.
Check your Documents folder. Look for unfamiliar .bat files or recently modified folders that you did not create.
Run a full system scan. Use Windows Security, Malwarebytes, or your preferred antivirus to check for leftover scripts or suspicious processes.
Review your Steam Workshop subscriptions. Unsubscribe from any Meccha Chameleon maps you do not actively use, and disable auto-downloads for Workshop content in Steam settings if you want an extra layer of control.

A clean overhead shot of a modern keyboard and mouse on a wooden desk, with a subtle green security checkmark glowing on — Running a full system scan can catch leftover scripts.

If you spot a suspicious map, report it directly through Steam. The reporting flow is located on the Workshop item page, and Valve’s Trust & Safety team will review it alongside community flags.

The Bigger Picture for Steam Workshop

This incident highlights a structural weakness in how Steam handles user-generated content. Workshop items are sandboxed in theory, but Unreal Engine blueprints and similar scripting systems can sometimes reach beyond the game folder if developers do not lock down file system access. Valve has stated previously that similar infections could happen again, which points to an ongoing arms race between content creators, malicious actors, and platform moderation.

For now, the safest approach is skepticism. If a map asks you to join a lobby, auto-downloads without warning, and behaves oddly in the background, treat it as a potential threat until proven otherwise. The Steam Workshop remains an incredible resource for PC gaming, but it requires the same caution you would apply to any third-party software installer.

Source: Latest from Windows Central

Over to you: Have you already downloaded any Meccha Chameleon Workshop maps, and did you notice anything unusual on your system?