These Popular Steam Workshop Custom Maps Secretly Install PC Malware

While Steam's anti-malware efforts have improved over the years, malware still winds up on Steam servers on occasion, usually due to it being snuck into Steam Workshop mods. Last time we discussed the problem, it was related to malware-infected live wallpapers distributed through Wallpaper Engine's Steam Workshop page, and this time Meccha Chameleon fell victim to a malware campaign.

Specifically, Meccha Chamelon's Steam Workshop was attacked with two map uploads: Laser Tag Neon and Chroma Grid Arena, both of which contained Remote Access Trojans (RATs) alongside the functioning game files. When a developer investigated the maps in question, his Discord account was hijacked, leading to the original Meccha Chameleon Discord server getting taken over by the attackers, forcing players and developers to abandon it.


According to an extended investigation posted by @FeintBE on Medium, these malware-infected Workshop maps worked by executing the malware when a match is initiated. The malware would use an Unreal Engine Blueprint to download and run batch (.bat) command files that attempt to use PowerShell to retrieve a remote file, likely for RCE (remote code execution) or data exfiltration purposes. Feint wasn't able to identify the exact nature of the second stage attack since the remote file was no longer reachable, but based on what happened to the Discord server, we can be sure it was capturing personal data.

Fortunately, both of the infected Workshop maps have since been removed from Steam, and Meccha Chameleon was been updated to version 3.1.0, which patches the exploit that attackers had been leveraging. This means that the game itself should be safe, and that users that installed but did not play the maps before they were taken down should also be OK.

However, the developers still urge players who subscribed to these maps to check their systems for malware, run a system scan (via Malwarebytes, etc), and even consider an OS reinstall if they were infected. It's unfortunate for Meccha Chameleon, but does still speak to the game's success. With over 1 million copies sold since its June 10th launch and peak players averaging between 30-40K at time of writing, the hide-and-seek game remains a remarkable success. Hopefully, Feint and others' work to secure the Workshop will contribute to its longevity.