Meccha Chameleon Workshop malware led to Discord server hijack, RAT infections

A security flaw in Meccha Chameleon's mod-loading pipeline led to a Remote Access Trojan (RAT) campaign and the hijacking of the game's official Discord server. The incident highlights how a game's own asset-execution logic, not the Steam Workshop platform itself, can be turned into a malware delivery mechanism.

How the attack was discovered

The campaign was first documented by independent reverse engineer Feint, after players reported a Command Prompt window briefly flashing while loading a custom community map. Investigation traced the behavior to a Workshop upload called Laser Tag Neon, which contained hidden Unreal Engine 5 Blueprint logic despite passing Workshop review. A second suspicious upload, Chroma Grid Arena, briefly appeared as a replacement before it was also removed.

Inside the malicious Blueprint

When a player loaded the infected map, a Blueprint originally named BP_RCE_Test (later renamed BP_AmbientController) triggered automatically through Unreal Engine's BeginPlay event. Rather than performing any lighting or environment function, it constructed a file path and wrote data to disk.

The written file, s.bat, was dropped into the victim's %USERPROFILE%\Documents folder. Its content was structured as a JSON/batch polyglot, valid JSON that also functioned as an executable batch script when run directly.

From dropper to RAT

Once written, the script relaunched itself, then used a hidden PowerShell instance with an execution-policy bypass to download a second-stage script from a hardcoded command-and-control server. That second-stage payload was later confirmed to install a persistent RAT, giving attackers remote control of infected systems.

Discord server hijacked mid-investigation

The incident escalated when a spare test machine used by a system engineer investigating the malware was itself compromised. Attackers used that foothold to bypass two-factor authentication on an administrator's Discord account, alter server permissions, and ban official staff members. The takeover affected the game's official Discord server, which has nearly 100,000 members. Access was later restored.

Response and recommended precautions

Developers released version 3.1.0 to patch the vulnerability and prevent Workshop maps from launching external processes. The flagged maps have been removed from the Steam Workshop. The development team confirmed that the game's source code and production systems were not compromised.

Players who loaded custom maps before updating are advised to run a full antivirus scan, check %USERPROFILE%\Documents and %TEMP% for unauthorized batch files, audit Windows Task Scheduler and Startup entries for persistence mechanisms, and update to version 3.1.0 or later.