{"id":568,"date":"2026-07-28T00:10:31","date_gmt":"2026-07-28T00:10:31","guid":{"rendered":"https:\/\/aimoneylab.ai\/?p=568"},"modified":"2026-07-28T00:10:31","modified_gmt":"2026-07-28T00:10:31","slug":"meccha-chameleon-players-are-getting-malware-from-user-made-maps","status":"publish","type":"post","link":"https:\/\/aimoneylab.ai\/?p=568","title":{"rendered":"Meccha Chameleon Players Are Getting Malware From User-Made Maps"},"content":{"rendered":"<div>\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.gamespot.com\/articles\/in-an-era-of-ai-slop-meccha-chameleon-embraces-human-crafted-chaos\/\" target=\"_blank\" rel=\"noopener\">Meccha Chameleon<\/a>&#8211;a multiplayer prop-hunt game that&#8217;s been blowing up on Steam lately&#8211;seems to have hit its first real road bump since it launched in early June. As pointed out by a player who goes by Feint, some of the game&#8217;s player-made maps are basically just Trojan horses containing malware. One of Feint&#8217;s friends had mentioned briefly seeing a command prompt appear while they were downloading the map. Curious, Feint dug into the files and concluded that the map known as Lazer Tag Zero contained a &#8220;malware dropper.&#8221;<\/p>\n<p class=\"wp-block-paragraph\">The map was quickly pulled from Meccha Chameleon&#8217;s Steam Workshop page after Feint <a href=\"https:\/\/medium.com\/@FeintBE\/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown-d1ac29565265\" target=\"_blank\" rel=\"noopener\">published their findings<\/a> in a Medium article. But the chaos was just beginning. Other malware-filled maps started appearing, and then the game&#8217;s official Discord server was hacked.<\/p>\n<p class=\"wp-block-paragraph\">&#8220;Security was completely breached, the server creator&#8217;s account was hijacked, and all admins were banned, so we can&#8217;t take action from our side,&#8221; Meccha Chameleon creator Lemorion_1224 <a href=\"https:\/\/x.com\/lemorion1224\/status\/2081056013424460118\">shared in an auto-translated X post<\/a> over the weekend.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">The news was also shared via an <a href=\"https:\/\/steamcommunity.com\/app\/4704690\/eventcomments\/587306992930251352?snr=1_2108_9__2107\" target=\"_blank\" rel=\"noopener\">update on the game&#8217;s Steam page<\/a>, clarifying that the game itself wasn&#8217;t a security risk, and could still be played safely as long as user-made maps weren&#8217;t used. Still, things were looking rough&#8211;the hackers even put up a fake listing for a Meta Quest-compatible version of the game, which doesn&#8217;t exist.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">&#8220;Currently, a product called &#8216;Meccha Chameleon VR&#8217; is available for preorder on the Meta Quest store, but we have not granted any production permission for it,&#8221; <a href=\"https:\/\/x.com\/lemorion1224\/status\/2081651259808038953?s=20\">Lemorion_1224 explained<\/a> in an X post shared early this morning. &#8220;We are currently submitting a request for removal, so please refrain from purchasing it. We will not handle any monetary issues arising from counterfeit products.&#8221;<\/p>\n<p class=\"wp-block-paragraph\">But after a weekend of abject chaos, it seems things are finally stabilizing. A few hours after the announcement about the fake Meta Quest product listing, Lemorion_1224 revealed that a new update is now live for the game.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-x\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"ja\" dir=\"ltr\">\u300a\u3081\u3063\u3061\u3083\u30ab\u30e1\u30ec\u30aa\u30f3\u300b<br \/>\u30df\u30cb\u30a2\u30c3\u30d7\u30c7\u30fc\u30c83.3.1\u304c\u914d\u4fe1\u3055\u308c\u307e\u3057\u305f<\/p>\n<p>\ud83d\udd27\u30bf\u30a4\u30c8\u30eb\u753b\u9762\u306e\u30c7\u30a3\u30b9\u30b3\u30fc\u30c9URL\u3092\u4fee\u6b63<br \/>\ud83d\udd27\u300c\u3075\u304f\u3088\u304b\u300d\u306e\u7269\u7406\u30b3\u30ea\u30b8\u30e7\u30f3\u3092\u4fee\u6b63<br \/>\ud83d\udd27\u30a6\u30a4\u30eb\u30b9\u5bfe\u7b56\u3092\u3055\u3089\u306b\u5f37\u5316<\/p>\n<p>&mdash; LEMORION\ud83c\udf0c\u30ec\u30e2\u30ea\u30aa\u30f3 (@lemorion1224) <a href=\"https:\/\/x.com\/lemorion1224\/status\/2081710107214426595?ref_src=twsrc%5Etfw\">July 27, 2026<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/div>\n<\/figure>\n<p class=\"wp-block-paragraph\">Mini-update 3.3.1 replaces the Discord link on the game&#8217;s title screen with a link to the correct server (which is now back in the possession of Mecca Chameleon creators Lemorion_1224 and Haganiero), fixes a physical collision issue, and perhaps most importantly, strengthens virus protection, though it&#8217;s not clear if the issue with player-made map malware has been fully resolved for good.<\/p>\n<p class=\"wp-block-paragraph\">For now, the safest bet is probably sticking to the game&#8217;s default maps.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Meccha Chameleon&#8211;a multiplayer prop-hunt game that&#8217;s been blowing up on Steam lately&#8211;seems to have hit its first real road bump since it launched in early June. As pointed out by a player who goes by Feint, some of the game&#8217;s player-made maps are basically just Trojan horses containing malware. One of Feint&#8217;s friends had mentioned [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[16,17],"tags":[],"class_list":["post-568","post","type-post","status-publish","format-standard","hentry","category-gaming","category-news"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=\/wp\/v2\/posts\/568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=568"}],"version-history":[{"count":0,"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=\/wp\/v2\/posts\/568\/revisions"}],"wp:attachment":[{"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aimoneylab.ai\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}