{"id":72204,"date":"2026-07-28T06:49:44","date_gmt":"2026-07-27T22:49:44","guid":{"rendered":"https:\/\/sgbuzz.com\/?p=72204"},"modified":"2026-07-28T06:49:44","modified_gmt":"2026-07-27T22:49:44","slug":"meccha-chameleon-players-are-getting-malware-from-user-made-maps","status":"publish","type":"post","link":"https:\/\/sgbuzz.com\/?p=72204","title":{"rendered":"Meccha Chameleon Players Are Getting Malware From User-Made Maps"},"content":{"rendered":"<p><br \/>\n<br \/><img decoding=\"async\" src=\"https:\/\/www.gamespot.com\/wp-content\/uploads\/2026\/07\/Meccha-Chameleon.jpg?w=300\" \/><\/p>\n<p class=\"wp-block-paragraph\">Meccha Chameleon&#8211;a multiplayer prop-hunt game that&#8217;s been blowing up on Steam lately&#8211;seems to have hit its first real road bump since it launched in early June. As pointed out by a player who goes by Feint, some of the game&#8217;s player-made maps are basically just Trojan horses containing malware. One of Feint&#8217;s friends had mentioned briefly seeing a command prompt appear while they were downloading the map. Curious, Feint dug into the files and concluded that the map known as Lazer Tag Zero contained a &#8220;malware dropper.&#8221;<\/p>\n<p class=\"wp-block-paragraph\">The map was quickly pulled from Meccha Chameleon&#8217;s Steam Workshop page after Feint published their findings in a Medium article. But the chaos was just beginning. Other malware-filled maps started appearing, and then the game&#8217;s official Discord server was hacked.<\/p>\n<p class=\"wp-block-paragraph\">&#8220;Security was completely breached, the server creator&#8217;s account was hijacked, and all admins were banned, so we can&#8217;t take action from our side,&#8221; Meccha Chameleon creator Lemorion_1224 shared in an auto-translated X post over the weekend.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">The news was also shared via an update on the game&#8217;s Steam page, clarifying that the game itself wasn&#8217;t a security risk, and could still be played safely as long as user-made maps weren&#8217;t used. Still, things were looking rough&#8211;the hackers even put up a fake listing for a Meta Quest-compatible version of the game, which doesn&#8217;t exist.&nbsp;<\/p>\n<p class=\"wp-block-paragraph\">&#8220;Currently, a product called &#8216;Meccha Chameleon VR&#8217; is available for preorder on the Meta Quest store, but we have not granted any production permission for it,&#8221; Lemorion_1224 explained in an X post shared early this morning. &#8220;We are currently submitting a request for removal, so please refrain from purchasing it. We will not handle any monetary issues arising from counterfeit products.&#8221;<\/p>\n<p class=\"wp-block-paragraph\">But after a weekend of abject chaos, it seems things are finally stabilizing. A few hours after the announcement about the fake Meta Quest product listing, Lemorion_1224 revealed that a new update is now live for the game.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"ja\" dir=\"ltr\">\u300a\u3081\u3063\u3061\u3083\u30ab\u30e1\u30ec\u30aa\u30f3\u300b<br \/>\u30df\u30cb\u30a2\u30c3\u30d7\u30c7\u30fc\u30c83.3.1\u304c\u914d\u4fe1\u3055\u308c\u307e\u3057\u305f<\/p>\n<p>\ud83d\udd27\u30bf\u30a4\u30c8\u30eb\u753b\u9762\u306e\u30c7\u30a3\u30b9\u30b3\u30fc\u30c9URL\u3092\u4fee\u6b63<br \/>\ud83d\udd27\u300c\u3075\u304f\u3088\u304b\u300d\u306e\u7269\u7406\u30b3\u30ea\u30b8\u30e7\u30f3\u3092\u4fee\u6b63<br \/>\ud83d\udd27\u30a6\u30a4\u30eb\u30b9\u5bfe\u7b56\u3092\u3055\u3089\u306b\u5f37\u5316<\/p>\n<p>&mdash; LEMORION\ud83c\udf0c\u30ec\u30e2\u30ea\u30aa\u30f3 (@lemorion1224) <a href=\"https:\/\/x.com\/lemorion1224\/status\/2081710107214426595?ref_src=twsrc%5Etfw\">July 27, 2026<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/figure>\n<p class=\"wp-block-paragraph\">Mini-update 3.3.1 replaces the Discord link on the game&#8217;s title screen with a link to the correct server (which is now back in the possession of Mecca Chameleon creators Lemorion_1224 and Haganiero), fixes a physical collision issue, and perhaps most importantly, strengthens virus protection, though it&#8217;s not clear if the issue with player-made map malware has been fully resolved for good.<\/p>\n<p class=\"wp-block-paragraph\">For now, the safest bet is probably sticking to the game&#8217;s default maps.<\/p>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<center><br \/>\n<br \/><a href=\"https:\/\/www.gamespot.com\/articles\/meccha-chameleon-players-are-getting-malware-from-user-made-maps\/\" target=\"_blank\" rel=\"noopener\">Read Full Article At Source <\/a><br \/>\n<center\/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Meccha Chameleon&#8211;a multiplayer prop-hunt game that&#8217;s been blowing up on Steam lately&#8211;seems to have hit its first real road bump since it launched in early&#8230;<\/p>\n","protected":false},"author":1,"featured_media":72206,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[32],"tags":[25272,9205,1924,25271,3392,27301],"class_list":["post-72204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech-gadgets-reviews","tag-chameleon","tag-malware","tag-maps","tag-meccha","tag-players","tag-usermade","wpcat-32-id"],"_links":{"self":[{"href":"https:\/\/sgbuzz.com\/index.php?rest_route=\/wp\/v2\/posts\/72204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sgbuzz.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sgbuzz.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sgbuzz.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sgbuzz.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=72204"}],"version-history":[{"count":0,"href":"https:\/\/sgbuzz.com\/index.php?rest_route=\/wp\/v2\/posts\/72204\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sgbuzz.com\/index.php?rest_route=\/wp\/v2\/media\/72206"}],"wp:attachment":[{"href":"https:\/\/sgbuzz.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=72204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sgbuzz.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=72204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sgbuzz.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=72204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}