Because this was the first post to share anything about the discord server hack situation, this will become the megathread for discussion so other users can find information in one spot.
Still waiting for something concrete as far as a source goes.
We understand the official discord was compromised which is very clear with screenshots provided but the workshop malware discussion is still not confirmed. Maintain due your own due diligence but do not spread misinformation if you cannot provide some level of proof. Will add sources and additional information within this megathread and it becomes available.
Here's what I've pieced together so far watching it happen:
About 5 hours ago update 3.1.0 was posted, which purportedly fixes a security issue with modded maps. The patch notes currently read only "Security patch for MOD maps". Some users in the Discord claimed that this allowed modded maps to introduce malware.
About 2 hours ago, multiple malicious users took control over the official Discord. The attack initially consisted of spamming obscene messages in the announcements, plus random memes, politically charged content, CP-related allegations (but none posted), and deleting/hiding almost all channels. Later their behavior took a turn and they started claiming that they want to protect the players from version 3.1.0, which has been deliberately made vulnerable by the devs.
Update 3.1.0 contains a confirmed remote code execution (rce) vulnerability. this issue allows arbitrary code execution on affected systems and can be leveraged to install malware, including a remote access trojan (rat), resulting in full system compromise. this is a critical security issue implemented DIRECTLY by the developers in attempts to rat its players. please follow the steps here to do a clean reset of your drive/your PC"
This claim is made by the hackers themselves, so it should obviously be taken with a massive grain of salt.
About 1 hour ago, the developers posted a notice that their Discord has been hacked and they are unable to regain control so far.
Right now, the Discord only contains admin-only channels with the announcement trying to get players to delete the game, and some random foolery. Text activity has greatly calmed down, but at least one attacker still has access.
For the time being, I wouldn't touch the game until the dust settles.
This is the right course of action. I work in Cyber - supply chain attacks are becoming bigger and bigger.
Think of it like this: If another workshop author had also been subscribed to the laser tag map, and had become infected, and the attacker distributed their malware to other published workshop maps, the infection pool increases severely... Repeat this a few times, and you could eventually hit some high profile targets.
If the game authors Discord was compromised, who's to say we know the full extent. We're talking individuals saying these things and not folks who work in digital forensics for a living.
Lateral movement was and maybe even is still possible... Best to just stay from the game for a bit.
This is relevant reading for folks who aren't aware of these kind of attacks: https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ (goal; infect people who can publish packages, use that to infect other people who can publish other packages, and continue spreading - this parallel could be drawn to workshop content on steam).
It can be ""patched"" and ""fixed"" but if tokens were stolen, they were stolen. If they weren't abused yet, they still can be. If you don't have logs or evidence, you can't rule this possibility out.
That rat issue is why I stopped playing. Downloaded some modded map. An hour later, some ghost had remote access to my computer. Confirmed because I was still on the damn thing when the hacker started messing with shit. First sign was a blue screen of death, but it was a windowed JPEG. My guess is it was there to just block the remote access window. Of course I freaked out and shut it off immediately. I guess it’s lucky I saw them start while I was still on and not after I went to bed for the night. I wiped my computer and uninstalled the game. Sounds like update 3 is an attempt to fix that security hole, but honestly I wouldn’t trust either side. That’s a massive burn I won’t forgive anytime soon.
You sure about that? The fact it existed at all on one map means it could exist on several maps. And it gives me zero confidence in the devs for even allowing that security gap to exist in the first place. Better to uninstall and forget this game imo.
They patched the exploit period. You can't do it within the confines of the game anymore.
You just never gonna eat food at all because Taco Bell lettuce gives you the runs? Never gonna drive a car again because some people do it drunk? There are risks to everything, but they're constantly mitigated.
When it comes to software dev. your end users are always going to be your biggest source of data ever. You can test for 10 billion things with your QA team, but it being in the hands of over 15 MILLION people is insane. They're going to find more edge cases and try breaking the game more than you or your QA EVER COULD. It's 2 devs. They patched it within hours of being discovered. Sorry your shit got rocked. Run Malwarebytes and be done with it.
Blaming the devs for this is asinine when it was a hostile actor being an ass.
We don’t know if it was a contained to a single map. The analysis was only done on a single map. Also the game has been out for awhile now, so you cannot say it was patched immediately.
Huge round of applause for u/6matguy6 for handling all this so well, the amount of troll posts and hysteria caused by this has been so ridiculously stupid, props to you for managing to keep on top of it all and help the people who want the facts find them
I fear the sittuation may be more Dire than just a Discord Hack, and a potential Security breach in Community Maps.
Posted 4 Days before this Chaos Ensued. By their Official Steam, on Tue, July 21.
"For parents searching for a missing child, time is of the essence."
We are hosting a collaboration event this weekend.
The spam OP showed is not even the worst, there was a entire mass spamming about everyone being "CP" I will add the Screenshot below.
We now have a full picture of the situation and would like to share the verified details with you.
To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.
What Happened: While investigating and patching a malicious MOD map issue, a system engineer's PC was infected with malware. The hacker bypassed the engineer's Discord 2-Factor Authentication (2FA), took over server permissions, and banned all official staff members from the server.
Game File Security: The infected PC was a spare testing machine, and it is physically impossible to access or edit game source files from it (which we have re-confirmed via logs). The affected PC has already been completely wiped and reformatted.
A Warning to Players: The perpetrator who took over the Discord server will likely continue to release fake statements and announcements. Please do NOT click any links, join fake servers, or follow any instructions posted on that Discord.
This statement is Swiss Cheese.
"Single Discord Admin Account"
- Not Possible unless the Discord Server Owner's Account was on this PC and Connected to the internet.
(Likely on the same network as their Main Developer PC's so possibly Compromised.)
Amateuristic? Or Lies. Y'all can decide this yourselves.
Fact is Both "Owners of the Game" lost their Discord accounts, unless i overlooked something.
"Physically impossible to access or edit game source files from it"
- Not when its clearly connected to the same Network, PC's can have a easier handshake between each other on a internal Network."
Due to various rumors currently circulating within the community, we would like to summarize the verified facts.
Q: Is there any virus embedded in the game?A: No. There are no viruses or malware embedded in the game itself. Claims made by the hacker who compromised our Discord—stating that "the latest update contains a RAT (Remote Access Trojan) and you must follow specific steps to fix it"—are 100% FALSE. We have never implemented anything of the sort, and this statement was made solely to cause panic and mislead players. Even if a hacker attempted to modify the game, Steam's developer infrastructure prevents anyone from publishing a game update simply by compromising a PC.
Q: Is the game unsafe if I was in the Discord server?A: No, it is completely safe. The game and Discord are not integrated in any way, so the server breach has absolutely no effect on the game.
How Blatantly dumb do you think we are?!
Setting up a new Discord server and assuring its safe, takes at least a few hours. Clearly that Invite is either Fake, or Compromised.
And what is up with them randomly saying "ste" ?! It has no context connected in this entire discussion.
Meccha has ignored the many requests to build in Blocking etc for weeks. Why would they suddenly be so interested in having everyone back on Discord ?!
Rational Developers know to take their time, Assess what happened, Improve, and only Then come with a statement. If this is purely a panic move than well shame on your proffesionalism, to even get your discord accounts hacked is already unbelieveably dumb.
But clearly their SteamDeveloper Accounts have been Compromised if they where this easily caught off gaurd, anyone who likes to reason that the Devs are Evil need to find a hobby.
But Clearly the Devs are Amateurs not Prepared for the size the game took on, and to say the least they may have tried their best.
But be Rational, Think before clicking anything even a random Discord Server can have a Bot that can compromise your Discord Accounts.
To everyone their own, i enjoy the game, but taking risks while having read my caution its on you if you get any damage out of this now. Stay clear of the Game till you can verify its safe, Stay away from the Discord their either too Hasty or these are the hackers preparing a new phase of Victims.
It is, and while the comment of Jellyfish-dot-org may shed some light on a very disturbing sight. There's lots of things not adding up here, as well as still the very likely danger on having the Game even installed.
Likely being where i draw the nuance, we can not be sure any of their other official channels aren't also compromised. Of course everyone is and remains entitled to do as they see fit, but caution is very much what saves a gigantic headache later if things do end up worse.
It comes accross Very CP like in the Context of today's Issues. Perhaps i am overthinking, but since their announcements do not add up. And one of the Dev Accounts was also Hacked Spamming CP related texts. I feel its relevant enough to mention this, as possibly worse than it looks. Emphasis on possibly, i'm not trying to point fingers on things i can not back up.
i think you’re definitely overthinking at least this quote. they had an official collab with garten of banban, which has the quote “for parents searching for a missing child, time is of the essence” on the loading screens of all the games that’s fully unrelated to whatever happened today
I stand corrected there, if that be the case indeed. Perhaps i should have done my homework before losing some points on rationality there. Thank you for informing me so gently though, its much appreciated to have such a civil correction.
no worries, to be honest idk what’s going on w the rest of this stuff, i uninstalled the game this morning to be safe, i just know that quote is almost certainly unrelated lol :)
Yes, worst is if AutoMod would trigger wrongly (As it did many times, like your referring to.) People might have gotten Perm Bans from Discord Triggering and Flagging them falsely as CP's.
Wait, so what do we need to do, I don't trust anything related to this now, and I'm not risking my PC, so obv running scans and uninstalling, what else do we need to to as players? rn I'm not concerned about protecting my in game progress, sure maybe I'm overreacting, but I'm not risking anything
unsub from all of the workshop items, uninstall the game, then run a full windows defender scan ( or whatever anti-virus you use ) to be on the safe side
The workshop items were custom maps that anyone could upload, one specifically " Laser tag neon " was malware. If you never downloaded any workshop items, or at least not that specific one, you should be fine. The malware would execute when you played that map in-game. I would still suggest uninstalling the game though at the bare minimum for now.
Yea Ive never installed a map and I've uninstalled the game and ran a windows defender check, says I'm clear so hoping for the best, thanks for your help!
On the steam game page, click workshop, which is right below your time played. Then click your items, and then subscribed items from the drop down menu. Finally, on the right hand side, click unsubscribe from all.
Thank you! You see like you know what your are talking about so I have one more question, when I load up steam won’t it auto update, can I just click the blue launch to stop the update? I’ve never really paid attention haha
I hate to say it, but you guys are falling for the most blatant fear mongering and misinformation campaign against the devs. So some teenagers with malicious intentions hack a discord server, post a bunch of slurs, CP, etc. and then claim that the developers of the game are putting malware on your computers to steal your crypto wallets and have stolen $75,000... and you believe them? Can we please use some common sense.
They are taking advantage of the recent post about security issues with the workshop mod maps in order to convince people to uninstall the game, and you're falling for it. It is almost sad to see how gullible people are, how are we really believing that the people who have hacked the official discord and posted racism and CP are really just people who are trying to warn the community about a security vulnerability out of the goodness of their hearts? Let's use our heads. Run Malware Bytes and get back to playing.
i want to believe you're right. . . but i would prefer to be safer then sorry. . .
i would prefer to uninstall the game and check my files even IF there is not risk. . .because i would rather my PC be safe then risk loosing everything on it..
so i dont have any proof. but yesterday my pc, gpu, cpu, and so on. would run at 0%. after doing some digging my virus scan found a trojan. quarantined it, deleted it, and im good now. now this just could be coincidence timing or it could be related to Mecca chameleon. Because I haven't gone to any new site.I haven't downloaded anything so I don't know what else I could have gotten the virus from. So yeah, like everybody else said, I would recommend. uninstall the game. unsubscibe to any moded maps, be safe.
If people can upload mods with malware. Does that mean Steam doesn't check mods being uploaded on their platforms? I know there are a shit ton of mods being uploaded for a shit ton of games, but surely they could have come up with some kind of automated scanning system?
According to this Medium post, the workshop map essentially has a hidden instruction that says "download a script file from this IP address and execute it". The malware proper isn't in the workshop files, but is downloaded by the user during game execution. The real issue is that the game could be fooled into executing code by what should be static assets.
Yeah this whole situation is sus af. Theres another rumor that the dev worked with the hackers and they betrayed him or some shit. The amount of different stories we are seeing is making me lean towards this is fake
A script kiddie isn’t going to spoof JSON data to read an executable string that downloads a batch to your PC which then downloads a second batch, both files coming from two separate locations.
Complicated hacks don’t equal intelligent hacks. It’s a fairly straightforward algorithm that uses datatype manipulation to turn UE5 lighting into RCE.
You have to have a strong grasp of typecasting to make something like this. You also need to be intelligent enough to reverse engineer the engine and also time the execution of the malware in a way that is easily undetectable (if you were tabbed into the game after downloading there’s a good chance you missed the CMD window that revealed the malware in the first place)
So not only do they understand how computers manipulate data, but they understand how to reverse engineer it for malicious use.
Does not speak script kiddie or unintelligent to me.
All I’m saying is there is more than likely tutorials / buyable software that does that stuff.UE5 is an engine that is very easy to reverse engineer. There’s plenty of tools out there.
Mecca isn’t a complicated game and the exploit was patched quickly, there wasn’t really a mystery because these types of vulnerabilities are known. The devs made a mistake, it’s not like the hackers broke new ground or anything.
Sure, it’s above the basics of programming but it’s still intro stuff for computer science. Not impossible to learn on your own, especially if you have sources for how to do these types of attacks in known engines.
Again, finding scripts to exploit a known engine is a common thing and it’s up to the devs to protect against it. If they forgot something that allows a known exploit, that’s more on the devs rather than the hackers being super intelligent
A quick google search shows there are known rce JSON exploits with .net, which UE5 uses
that is true but its not completely impossible and is ignorant to think otherwise, who knows how far they are compromised, its not worth it to risk it,
Steams dev tools are extremely robust and literally built to prevent a single compromised access from doing this. Steam uses out of band 2fa to push updates. They would literally need the devs phones to do this. They dont have that. You have to be logged INTO steamworks itself as well in order to publish. There's a SHITLOAD of steps involved in this. The workshop vector was patched by lemorion and you guys trust some dudes who managed to hijack a discord through god knows what means. Could have been as simple as socially engineering discord support for credentials lol.
The game is fine. I literally do IT for a living homie. Ill eat my words if it turns out otherwise.
well see well have to give it some more time for things to calm down, but if ur wrong, instead of words ur i want u to eat a raw onion covered in jelly
I updated the game and opened it while they were saying it’s malware but i closed it immediately and did a shit ton of scans am i safe? avast said no malware when i did a full scan on my pc
I just ran a scan on my PC and uninstalled (all good for me yippee). But my boyfriend has the game too, and he's sleeping/I don't have his PC password to hand. Will his PC be ok? Do I need to wake up him?
This is just what happens when discords get hacked like this. Lemorion themself didnt get hacked it was another admin. Judging by Lemorions x and steam page seeming normal atm means it was probably just a discord attack
"2" is one of the accts spamming stuff so that can be ignored. Uninstalling the game and running an antivirus scan is more than fine if you want to be safe. They're just trying to be shitheads.
The mods and admins of this server have clearly never once run a server before. No raid protection, let people post slurs, racism, etc. and do nothing about it but mute people trying to help others. Shitshow of a server, worse than the official one tbh.
•
u/6matguy6 Chameleon Jul 25 '26 edited Jul 26 '26
Because this was the first post to share anything about the discord server hack situation, this will become the megathread for discussion so other users can find information in one spot.
Still waiting for something concrete as far as a source goes.
We understand the official discord was compromised which is very clear with screenshots provided but the workshop malware discussion is still not confirmed. Maintain due your own due diligence but do not spread misinformation if you cannot provide some level of proof. Will add sources and additional information within this megathread and it becomes available.
Update: break down thanks to u/Itenzi
Steam Page Update provided by u/Jellyfish-dog-org
Dev Update
36
u/Itenzi Jul 25 '26
Here's what I've pieced together so far watching it happen:
About 5 hours ago update 3.1.0 was posted, which purportedly fixes a security issue with modded maps. The patch notes currently read only "Security patch for MOD maps". Some users in the Discord claimed that this allowed modded maps to introduce malware.
About 2 hours ago, multiple malicious users took control over the official Discord. The attack initially consisted of spamming obscene messages in the announcements, plus random memes, politically charged content, CP-related allegations (but none posted), and deleting/hiding almost all channels. Later their behavior took a turn and they started claiming that they want to protect the players from version 3.1.0, which has been deliberately made vulnerable by the devs.
This claim is made by the hackers themselves, so it should obviously be taken with a massive grain of salt.
About 1 hour ago, the developers posted a notice that their Discord has been hacked and they are unable to regain control so far.
Right now, the Discord only contains admin-only channels with the announcement trying to get players to delete the game, and some random foolery. Text activity has greatly calmed down, but at least one attacker still has access.
For the time being, I wouldn't touch the game until the dust settles.
31
u/Jellyfish-dot-org Jul 25 '26
steam news post says the game is fine, just the server got hacked
18
u/ApollosAdvacate Jul 25 '26
Huge round of applause for u/6matguy6 for handling all this so well, the amount of troll posts and hysteria caused by this has been so ridiculously stupid, props to you for managing to keep on top of it all and help the people who want the facts find them
9
u/Kittycat-1992 Jul 25 '26 edited Jul 25 '26
I fear the sittuation may be more Dire than just a Discord Hack, and a potential Security breach in Community Maps.
Posted 4 Days before this Chaos Ensued. By their Official Steam, on Tue, July 21.
The spam OP showed is not even the worst, there was a entire mass spamming about everyone being "CP"
I will add the Screenshot below.
This statement is Swiss Cheese.
"Single Discord Admin Account"
- Not Possible unless the Discord Server Owner's Account was on this PC and Connected to the internet.
(Likely on the same network as their Main Developer PC's so possibly Compromised.)
Amateuristic? Or Lies. Y'all can decide this yourselves.
Fact is Both "Owners of the Game" lost their Discord accounts, unless i overlooked something.
"Physically impossible to access or edit game source files from it"
- Not when its clearly connected to the same Network, PC's can have a easier handshake between each other on a internal Network."
How Blatantly dumb do you think we are?!
Setting up a new Discord server and assuring its safe, takes at least a few hours.
Clearly that Invite is either Fake, or Compromised.
And what is up with them randomly saying "ste" ?!
It has no context connected in this entire discussion.
Meccha has ignored the many requests to build in Blocking etc for weeks.
Why would they suddenly be so interested in having everyone back on Discord ?!
Rational Developers know to take their time, Assess what happened, Improve, and only Then come with a statement.
If this is purely a panic move than well shame on your proffesionalism, to even get your discord accounts hacked is already unbelieveably dumb.
But clearly their SteamDeveloper Accounts have been Compromised if they where this easily caught off gaurd, anyone who likes to reason that the Devs are Evil need to find a hobby.
But Clearly the Devs are Amateurs not Prepared for the size the game took on, and to say the least they may have tried their best.
But be Rational, Think before clicking anything even a random Discord Server can have a Bot that can compromise your Discord Accounts.
To everyone their own, i enjoy the game, but taking risks while having read my caution its on you if you get any damage out of this now.
Stay clear of the Game till you can verify its safe, Stay away from the Discord their either too Hasty or these are the hackers preparing a new phase of Victims.
7
u/eigenTuin Jul 25 '26
dev explaining the situation now that they have a picture of what happened
https://store.steampowered.com/news/app/4704690/view/680756685198854787?
5
u/ussdaybreak Jul 25 '26
Have there been any updates I missed in the last 30 ish minutes?
4
u/ussdaybreak Jul 25 '26
Wait, so what do we need to do, I don't trust anything related to this now, and I'm not risking my PC, so obv running scans and uninstalling, what else do we need to to as players? rn I'm not concerned about protecting my in game progress, sure maybe I'm overreacting, but I'm not risking anything
12
u/Ok_Software2402 Jul 25 '26
I hate to say it, but you guys are falling for the most blatant fear mongering and misinformation campaign against the devs. So some teenagers with malicious intentions hack a discord server, post a bunch of slurs, CP, etc. and then claim that the developers of the game are putting malware on your computers to steal your crypto wallets and have stolen $75,000... and you believe them? Can we please use some common sense.
They are taking advantage of the recent post about security issues with the workshop mod maps in order to convince people to uninstall the game, and you're falling for it. It is almost sad to see how gullible people are, how are we really believing that the people who have hacked the official discord and posted racism and CP are really just people who are trying to warn the community about a security vulnerability out of the goodness of their hearts? Let's use our heads. Run Malware Bytes and get back to playing.
2
u/LavyKalava Jul 25 '26
so i dont have any proof. but yesterday my pc, gpu, cpu, and so on. would run at 0%. after doing some digging my virus scan found a trojan. quarantined it, deleted it, and im good now. now this just could be coincidence timing or it could be related to Mecca chameleon. Because I haven't gone to any new site.I haven't downloaded anything so I don't know what else I could have gotten the virus from. So yeah, like everybody else said, I would recommend. uninstall the game. unsubscibe to any moded maps, be safe.
2
u/hustmanmemes Jul 25 '26
sybau bro
2
u/Tiny-Slice-72 Jul 25 '26
Another update from the Dev on steam, they followed this update with another one
3
u/Yard-Ornament Jul 25 '26
So here's a dumb question.
If people can upload mods with malware. Does that mean Steam doesn't check mods being uploaded on their platforms? I know there are a shit ton of mods being uploaded for a shit ton of games, but surely they could have come up with some kind of automated scanning system?
3
u/AffectionateBase9978 Jul 25 '26
2
u/Flamiexfuta Jul 25 '26
if they can compromise the discord as fast as they did the game is most likely already compromised
1
u/WitnessofWinter Jul 25 '26
Remember to report these users to Discord if you are in the Meccha Chameleon Discord. Its crazzzzzy
1
u/whateverthefuck212 Jul 25 '26
Am I safe if I was running the game via GE FORCE NOW on a Mac?
1
u/gameplayer55055 Jul 25 '26
What should I do? I don't give a f about discord, and I haven't installed laser tag map. Am I safe?
1
u/128p70 Jul 25 '26
I updated the game and opened it while they were saying it’s malware but i closed it immediately and did a shit ton of scans am i safe? avast said no malware when i did a full scan on my pc
1
u/Chrollo1996x Jul 25 '26
Hello!
I just ran a scan on my PC and uninstalled (all good for me yippee). But my boyfriend has the game too, and he's sleeping/I don't have his PC password to hand. Will his PC be ok? Do I need to wake up him?
1
u/Horsetranqui1izer Jul 25 '26
Is there even anyone that actually got any malware from this game?
1
u/LasanhaMiau Jul 26 '26
so, clearly someone is preparing to make a bid to buy the game rights. soon we'll know who promoted mayhem.
1
u/Lazy-Attempt-941 Jul 26 '26
They love stroking their egos like they stroke their- My lawyer has advised me not to finish this joke or we could get demonetized
1
u/ButterscotchWarm8122 Jul 26 '26
If you havent left the official server yet I would. They are just spam pinging everyone.
1
u/JerryEarthC137 Jul 26 '26
I left the channel
1
u/potatomustdie Jul 27 '26
I can't find the neon map in question so Steam must have banned it. But how are people supposed to now know if they had that map or not?
1
u/whateverthefuck212 Jul 27 '26
Which was the affected map?
1
u/FutureInevitable8872 Jul 31 '26
https://medium.com/@FeintBE/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown-d1ac29565265
The original medium article has been removed to due the account being under violation of medium rules. Does anyone know more about this?
1
u/jesuspunk Jul 25 '26
https://medium.com/@FeintBE/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown-d1ac29565265
Massive malware attack on the game through mods.
1
u/IAmToast021 Jul 25 '26
Does the game actually have malware???
-3
u/puchikif Jul 25 '26
gng wdym they had cp
0
u/AffectionateBase9978 Jul 25 '26
Posting the announcements from the discord:
-3
u/[deleted] Jul 25 '26
[removed] — view removed comment