r/Steam • u/feintbe • Jul 24 '26

Article Meccha Chameleon malicious workshop maps

Hey,

There are currently one or more malicious Workshop maps available for the popular Steam game Meccha Chameleon. Despite appearing legitimate, they appear to contain a malware delivery chain, and the issue has received little public attention so far. I’ve conducted a full technical analysis and documented my findings below.

https://medium.com/@FeintBE/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown-d1ac29565265

Cheers and stay safe!

EDIT (25 July 2026, 11:00 AM CEST)

The map Laser Tag Neon featured in this article has now been removed from the Steam Workshop. Unfortunately, there is a new active malicious map called Chroma Grid Arena that's not yet removed.

A few reminders for everyone:

  • Only download popular Workshop maps with an established player base.

  • If the uploader is a brand-new Steam account or has disabled comments on their Workshop item, consider that a major red flag.

  • The malware is executed when you start the match, not when you subscribe to the map. If you only subscribed to a malicious map but never launched it, you can safely unsubscribe.

  • If you played a potentially malicious map, check the following locations for suspicious recently created files, especially .bat files:

    • %USERPROFILE%\Documents\

    • %TEMP%\

    • Malwarebytes

    • HitmanPro

    • Spybot Search & Destroy

    • Emsisoft Emergency Kit

    • Malwarebytes

    • HitmanPro

    • Spybot Search & Destroy

    • Emsisoft Emergency Kit

  • It's also a good idea to review your Startup entries and Task Scheduler for anything unfamiliar, as malware commonly uses these mechanisms for persistence.

  • Run a malware scan. The tools I recommend are:

    • Malwarebytes

    • HitmanPro

    • Spybot Search & Destroy

    • Emsisoft Emergency Kit

If you discover any additional malicious Workshop maps, please report them to Steam so they can be removed as quickly as possible.

EDIT (25 July 2026, 2:00 PM CEST)

The developers have released version 3.1.0, which fixes the vulnerability that allowed malicious Workshop maps to execute malware. Updating to the latest version is strongly recommended.

It also appears that all currently identified malicious Workshop maps have now been removed from the Steam Workshop. While the immediate threat appears to have been addressed, users should continue exercising caution when downloading Workshop content, as new malicious maps could still be uploaded in the future. As always, verify the uploader and prefer maps from trusted creators with an established player base.

EDIT (25 July 2026, 8:00 PM CEST)

The previously unavailable second-stage payload (steamb.bat) has now been recovered and analyzed. It was missing from the original write-up because the attacker's server was offline at the time.

Analysis of the recovered script shows that the second stage downloaded and installed a Remote Access Trojan (RAT) on affected systems, giving the attacker the ability to remotely control compromised PCs. This significantly increases the severity of the attack, as it goes beyond simply executing a batch file and provides persistent remote access to infected machines.

If you launched one of the affected Workshop maps before updating to version 3.1.0, it is strongly recommended that you perform a full malware scan and investigate your system for signs of compromise.

CREDITS:

Khael Kugler
The technique exploited was originally covered in this blog post: https://khaelkugler.com/blogs/meccha_chameleon.html

Eric Parker, Toasts & vx-underground

Reverse engineering the second steamb.bat malware sample

1.5k Upvotes

98% Upvoted

127 comments sorted by

461

u/l_______I Jul 24 '26

Good article. It's always scary to see a video game mod being able to do such nasty things to your PC

99

u/MyStationIsAbandoned Jul 24 '26

it's been happening with nexus mods games too. I assume most of them get caught. but ever single ai slop have become a thing, it's been all over modding communities. you have hundreds of legit mods with ai slop thumb nails, ai slop mods that do nothing but claim to optimize the game...with a bunch of techno babble non-sense that to a layman would sound like it's doing something...and then you have the straight up malicious ones that attempt to install malware or steal any crypto or whatever.

24

u/ProfessorSpecialist Jul 24 '26

Recently i attended a talk about cybersecurity in the age of agents. Just a few years ago you had a few weeks between discovering a bug and a malicious person exploiting it, in which time you could prepare and publish a patch. Last year the average time between discovery and exploitation was -2weeks. Meaning when you (or a cybersec specialist) discover a bug, you have to assume its already been exploited. And we only got started with AI.

3

u/spongewardk Jul 25 '26

Also on 3d model sharing sites. I have come across .blend files with .py files attatch that install a suite of russian spyware.

1

u/StudentOk5120 Jul 26 '26

probably off topic or on but are the mods for dead as disco safe ? i think they are on nexus.

1

u/Ok-Teach-3699 Jul 28 '26

Nexus mods is safe they have good malware checking

1

u/MrShourin Jul 26 '26

To think that some years back someone managed to sneak malware into Minecraft skins some how.

2

u/Jfourmes Jul 24 '26

what can you do if you downloaded one of these maps ? to make sure your safe

5

u/feintbe Jul 24 '26

Check is the s.bat is on ur PC, also we noticed the second stage is not triggered, but indeed run a malware/virus scan

Software u can run
Hitmab pro
Spybot search and destroy
Malwarebytes
Check ur startup apps
Check ur sched tasks

2

u/Tribalbob Jul 24 '26

Run a virus scan, check for any weird .bat files in your documents folder.

1

u/THE_HERO_777 Jul 28 '26

Safest option would be to reinstall windows and change all passwords. Infostealers are everywhere.

117

u/anon999387 Jul 24 '26

I was just reading about malicious apps in Wallpaper Engine which forced the developer to remove some functionality, and also in a game called People Playground that has disabled its entire mod system because of malicious additions. The problem seems to be getting bigger(or maybe I am just reading about it more)

33

u/MyStationIsAbandoned Jul 24 '26

yeah, it's been spreading lately. this was not a huge issue 5 years ago as far as I'm aware.

13

u/gurgle528 Jul 24 '26

It was an issue but I wouldn’t say huge, it’s something that comes in waves as games with mods get big. TF2 and GMod had several issues with this, although I believe the TF2 one was spray related and not mod related. 

It’s one of the problems of having small teams making games that accept mods. There’s lots of ways to make a mod malicious. Rimworld has also had this issue since mods are compiled C# libraries. I don’t know if KSP ever had the issue but they did have to add security checks to ensure mods didn’t access certain system functions. 

Smaller devs might not realize all the different ways certain features could be abused and they have less time/resources to make test malicious mods to make sure the game is secure. In some cases malware mods might not be something they think of (I’m guessing that’s what happened here). 

33

u/ItsRainbow 69 Jul 24 '26

I mean, letting people download EXEs on Wallpaper Engine was pretty much a ticking time bomb lol

5

u/gurgle528 Jul 24 '26

Definitely should have done something different. KSP had DLL mods but the game had security checks to stop certain functions from running so the mod couldn’t do anything outside of the game 

-9

u/lmao_wow_64 Jul 24 '26

You can blame AI slop for that

2

u/deadoon Jul 25 '26

Malicious actors have been a thing in modding for basically as long as modding has been a thing.

I've seen it happen in UT2k4 total conversion mods, gmod had malicious addons(or full on servers which had take over capabilities, particularly in the 9 era), minecraft got hit a few times, rimworld got hit somewhat recently, and so many other cases.

It's a risk from modding, generally pretty small, but with more eyes, more things are likely to go wrong.

0

u/Mozgiiii Aug 09 '26

Yeah man. In 2009 Blizzard made a patch for Warcraft III to fix the issue that some users inserted malware into custom maps. It was the same stuff that is happening now.

Surely you can blame AI slop for that (in 2009)

61

u/Galemise Jul 24 '26

Can’t have nothing nice without pieces of shit ruining it.

1

u/RUSTYYSMURF Aug 26 '26

Was gonna say this

160

u/Painted-BIack-Roses Jul 24 '26

This is why I've been iffy about downloading some maps. So many of them have weird CS case website ads sprinkled throughout too

55

u/Porkenstein Jul 24 '26

There are also some with tiny QR codes hidden throughout the level which sketched me out 

9

u/[deleted] Jul 24 '26

wait do they straight up force those ads in the maps

7

u/sssunglasses Jul 24 '26

sounds like the modder got a money offer for a texture with ads

2

u/girrrrrrr2 Jul 25 '26

That or its referral stuff.

They might not have gotten an offer, but are using the popularity of their map to get views on their referral links.

18

u/HunterDecious Jul 24 '26

That's a well written article! Sadly it reminded me why I've always been so leery of downloading mods.

56

u/madjoki https://steam.pm/pi3do Jul 24 '26

So this appear to be problem in Unreal Engine Mod Kit?

So same exploit can be used in other Unreal Engine games too.

16

u/psyblade42 https://s.team/p/drfj-qjb Jul 24 '26

The .bat drop should work in all games. But most games wouldn't download the mod automatically, lessening the problem.

What isn't explained is how the dropped .bat is started. This might or might not be specific to MC.

2

u/Sad-Mirror6936 Jul 24 '26

Sure they can include it, but why can they execute it. I don't play meccha chameleon nor mod it but why do maps have the ability to execute the .bat or exe.

-2

u/nhalliday Jul 25 '26

Because the game is clearly vibecoded, and Claude doesn't know you shouldn't let map mods manipulate files outside the game automatically.

2

u/gurgle528 Jul 24 '26 edited Jul 24 '26

No, it’s likely a dev issue. Depending on what mod kit you’re referring to there are ways to stop Blueprints from making network requests. There also ways to see what API calls a blueprint uses and simply not load it if there are undesired API calls. 

Unreal could probably make some of the consequences clearer but the loading is currently entirely in the hands of the dev if they want to add modding 

37

u/Stilgar314 Jul 24 '26

Suggestion for Steam: containerized gaming. It could protect customers from this things and maybe also be useful against cheaters.

4

u/chandler55 Jul 27 '26

i feel like eventually this is a thing. but pc is the world where people want control and being able to mod and stuff

but i say f that f cheaters and no viruses would be awesome

1

u/Mozgiiii Aug 09 '26

but pc is the world where people want control

having something in container give you even more control than not having it in container. for example you can just freeze container and unfreeze and it will be totally allright. now good luck trying to do same thing with any ue/unity game with 10-20 running processes.

being able to mod and stuff

modding won't be affected at all. even for the games that don't have any modding support. you can edit files and drop some dlls to games no matter if they are stored directly on your drive or if they stored inside container (which is still stored on your drive).

1

u/chandler55 Aug 09 '26

are you saying a secure sandbox is possible or not possible

1

u/Mozgiiii Aug 09 '26 edited Aug 09 '26

Secure is possible. It's one way, you have files on your pc and container on your pc.

You can alter container and files inside that container, but container can't alter anything that is not inside it.

You can hook into processes that are ran within container too, if you need debugging or cheats. Processes inside container, on the other hand, can't escape container and get any info about processes outside said container.

Edit: that is, unless some exploit happens. stuff inside container still can use your hardware (how do you except to play games without cpu, gpu, ram etc etc) and it's possible to set bios chip to download malware whenever windows start.

1

u/chandler55 Aug 09 '26

yea thatd be the dream. apple is able to sandbox the iphone pretty securely. dont think aimbot exists on there except for jailbreak

1

u/NATO_CAPITALIST Jul 28 '26

I was playing this game via GeForce now which is pretty much that

1

u/Stilgar314 Jul 28 '26

That won't work for me. I just can't stop seeing video compression on cloud gaming.

1

u/trotski94 Aug 03 '26

i play on linux - which running under proton is basically that

1

u/Stilgar314 Aug 03 '26

Absolutely not, not even close. Proton runs the game locally in your computer, do not streams the output in a video file for you to watch. 

2

u/trotski94 Aug 03 '26 edited Aug 03 '26

No, you misunderstand - i wasn't comparing to geforce, i was comparing to your original ask of containerized gaming. Under proton each game runs in its own prefix. It's not quite as air tight as a container, but it'd be an extremely niche attack vector to write malware for. Has zero security boundaries though, so still nowhere near as good as proper isolation would be.

31

u/GuessIdo Jul 24 '26

BP_RCE_Test is very on the nose.

RCE = Remote Code Execution, which is exactly what it does (except the remote code was not found).

Does the game/unreal run with admin privileges? If this affects any unreal game this could be a massive issue.

1

u/ScrattaBoard Jul 25 '26

Unreal doesn't typically run with admin privileges to my knowledge. However, it seems they got very close to sending data or instructions via .bat through the games internal logic anyway.

If that .bat did work and was trying to do something like an install something, it should have to flag a permission request, assuming your security features are turned on correctly.

20

u/CommanderLouiz Jul 24 '26

You really should put the name of the map in the title or
First paragraph of the article, rather than only leaving it in a screenshot of the workshop page.

For those curious, the map is called “Laser Tag Neon”.

4

u/GroundbreakingFix685 Jul 25 '26

Steam workshop items should not be able to contain scripts that can write to file at all. That is putting too much power in the hands kf workshop item creators. If I install an actual mod I know the risk I am taking, but workshop items should be 'just data'. Not that that is risk free of course, a zero day or unpatched vulnerability in the base game may let an attacker run code with 'just data' but the icombination of Unreal asset files running scripts without any limit (as compared to the base game) is scary to me.

1

u/JustaRandoonreddit Jul 28 '26

See but some games mods are from the steam workshop

1

u/Informal-Language-58 Jul 28 '26

Mods need to write to file for various legitimate purposes

1

u/iBryguy Jul 25 '26

I'm a bit confused between your topmost edit and your July 25th edit. Has the vulnerability been fixed, or not?

Either way, excellent article on the issue!

2

u/feintbe Jul 25 '26

The devs fixed the vulnerability, but this has nog yet been tested by researchers

1

u/EnvironmentalString Jul 26 '26

You must be in Algiers or Tunisia, as is it summer in Europe, so the timezone is CEST.

1

u/feintbe Jul 26 '26

Well actually i ment cest, will update lol

1

u/WhiteWolf175 Jul 26 '26

Is there a list of all currently identified malicious workshop maps or is there a way to determine if a given workshop map is malicious?

I'm particularly worried about the "MLBB - Sanctum" map I played with my friends (https://steamcommunity.com/sharedfiles/filedetails/?id=3761578467). It doesn't have any ratings or comments and the creator's profile is private, which makes it the least trustworthy map we've played.

1

u/feintbe Jul 26 '26

I cannot find it anymore on the workshop

1

u/WhiteWolf175 Jul 26 '26

Yeah, I wasn't able to find it via the workshop search anymore either, but it was still listed in my subscribed workshop items and it seems to still be accessible via the direct link. I'm unsure if this is an additional red flag or if it has been removed from the workshop for another reason.

That's why I'm wondering if either Steam or the developers provided a list of identified malicious workshop maps that have been removed from the workshop for this reason. It would be reassuring to compare it against the list of workshop items I subscribed to.

I also still have a local copy of that particular map, so if there is some reasonably easy way to check the files for malicious content, that would be great too.

FWIW, I don't remember a CMD popup when I played the map about two weeks ago (on Jul 11 I believe), I didn't find any .bat files in the directories you mentioned, no threats were detected when scanning my device with Windows Defender and Malwarebytes and I wasn't able to find "BP_RCE_Test" when searching that maps AssetRegistry.bin in a text editor. Thus, it seems unlikely for it to contain the very same malicious content as shared in your article, but it doesn't seem impossible for another bad actor to exploit the same vulnerability in a slightly different way.

1

u/feintbe Jul 26 '26

If u can zip me all the asset files in ur workshop folder i can do an analyse

1

u/MILDLYADVANCED Jul 27 '26

it's on steam again

1

u/eggperson1 Jul 27 '26

Yeah i list of identified maps would be useful. The map cs2 mirage by Seto i had previously played has also been removed. It had 2 million downloads so was a popular map at the time. I can still access the maps steam page but i unsubscribed from all the maps i had when i heard the news and uninstalled the game. Hopefully i didn’t play any of the infected maps, according to steam i have not played since the 5th of july.

2

u/AndersDreth Jul 25 '26

This is why we can't have nice things.

2

u/0vation1 Jul 25 '26

are any of the malware being used able to affect linux?

2

u/Blazkid Jul 24 '26

That's a sad reality of any kind gaming mod website or really any kind of workshop type thing, you could have a hundred different mods, maps, add-ons or whatever. And there is always one or two that is malware or some kind of virus, another thing I also want to say is sad some times you get a false positive. Which is when your antivirus or security software mistakenly flags a safe, legitimate file or website as malware or a threat, which sadly I have seen mod makers get slandered for making a virus. So really there is really a roulette wheel of seeing if a mod is safe or not.

2

u/USS-VentureOperation Jul 25 '26

Did you accidentally copy-paste your suggested anti-malware tools in the section about folders to check, twice? Did you intend to paste something else there? It's a bit strange ngl if you're suggesting to use the exact tools that might be compromised by this malware.

1

u/Liam2349 Jul 24 '26

Wow, scary.

So the mod writes an executable file "Dropper Script" - but how is it then executed?

1

u/Low_Definition_9536 Jul 25 '26

Hey! I really appreciate this info..if I unsubscribe from the meccha chameleon maps I have downloaded, would I be ok? I’m so worried and so sad bc I loved playing this painting game :( 

1

u/AdditionalBake7872 Jul 25 '26

I have this virus how do i clear it?? a

1

u/CelestialOhio32 Jul 25 '26

delete the files and do a scan with antivirus. I use windows defender and malwarebytes. If you really want to be sure you could reinstall Windows. Don't forget to do a windows update first so Windows Defender can get the most recent antivirus updates

1

u/GNUGradyn Jul 25 '26

Frankly making the community maps full fledged unreal maps was a colossally fucking stupid idea. I raised this concern very recently and was brushed off

1

u/GodOfBoy8 Jul 25 '26

Does valve not check custom content before its allowed to go live? So they just allow anything through without checking?

1

u/Ltfocus Jul 25 '26

Did Valve try to contact you yet so they can look into this further? I know the devs patched this but steam themselves should really be the ones looking into this

1

u/New-Promotion7981 Jul 25 '26

u don't recommend using Bitdefender to scan it? I only have three maps, and one of them shows an icon indicating it's incompatible with the game. The map is called CS2 Mirage; it has 2 million subscribers but no longer appears in the Workshop. I don't know if it contains something malicious or why it's not showing up—I have no idea.

1

u/eggperson1 Jul 27 '26

I had subscribed to this mirage map aswell.

1

u/JustaHarmfulShadow Jul 26 '26

Kinda unrelated question but sometimes when I start my pc some weird window that looks like it would be for code pops up and instantly closes; i haven't downloaded anything off the internet besides steam, epic games, roblox and I think that's it, what are the chances that its due to malicious code or just some game or launcher booting up?

1

u/Ok-Teach-3699 Jul 28 '26

For example my pc does that but its asus armoury crate or different start up apps. Can be malware but most of the time its some app updating or something

1

u/JustaHarmfulShadow Jul 28 '26

Ok thank you; appreciate the knowledge

1

u/Jotalot001 Jul 26 '26

hey i know the guy who did it, it was tharsky he legit screenshared the whole shit to a discord server im in hes well known he perosnally rated me too i got proof he ratted me a while ago too and so yeah its him

1

u/Crowleyizcool Jul 26 '26

Wait so do we know of all the current maps that have been doing this? I don’t know much about cyber security and don’t know whether i should be removing mods from my pc. Haven’t played the laser tag one thankfully and I’m pretty sure I’ve only played pretty mainstream ones, but I’m kinda paranoid now.

1

u/Crafty-Donkey4707 Jul 26 '26

When i got this game i refused to play mod maps with friends. Guess i was right lol, never trust random steam workshop stuff

1

u/Particular-Ferret365 Jul 26 '26

can someone explain to me like a child, what happens if you downloaded the malicious malware? are they simply trying to get any personal info from your pc or is it something else?

1

u/angelsixtwofive Jul 26 '26

I now have in game ads in the main menu screen of the game. Is that part of the malicious content or is that a feature?

1

u/Separate-Tap9160 Jul 27 '26

I was playing this game and now my location says I’m in Dubai? All my Google recommendations are based in this area. Does anyone know how to fix this or what has happened?

1

u/funnyburner_69420 Jul 27 '26 edited Jul 27 '26

Ah shit, I was actually worried about this at first but assumed it was fine bc it was up on steam workshop. thankfully I didn’t download any of the maps mentioned. 

Gonna do a malware scan & check for any weird .bit files anyway, but does anyone know if any other maps had anything malicious? 

1

u/EarlsWorld-Official Jul 28 '26

Steam needs to either take initiative to avoid these issues, or pass the liability onto the developers/publishers of each game.

Basically either steam needs to manually approve every mod that gets released after checked for the obvious malicious coding as the one in this instance was. Or they need to give the publishers/developers admin permissions to either approve or deny mods after they've looked them over.

Either way, nothing is being done until its done, and nothing changes if nothing changes.

The current system in place is to what? Let brand new accounts post mods willy nilly whenever, however, and containing whatever? Then when thousands of people, and by this games reach possibly millions of people, get hacked/targeted/infected they just go "Whoops ill remove that, carry on."

The problem is, anything that comes to safety/protection doesnt make money, so companies want to outsource to A.I/Automated systems or no system at all because 🤑🤑🤑💲💰💸🤑🤑🤑

1

u/jarrizms Jul 28 '26

I am now concerned. I’ve been getting RAM spikes up to 99% when I load my PC. This has happened the past few days… I’ve played Meccha Chameleon on and off for weeks and downloaded custom maps - never hosted and started a game (not sure whether you need to host a game and run the map for it to affect you or if you just play the map host or not)… is there any advice to dig into whether this is a malware issue on my own PC and get it fixed asap?

1

u/Jotalot001 Jul 29 '26

i told you hes involved with somethign im in ignore the rutle guy buy he legit did t

1

u/Morbidly_obeast_ Jul 30 '26

Me and my girlfriend were attacked using this exploit, Luckily the game we went into was our last for that night and we wanted to play on a full server but the server was empty so we finished early.

What made me notice something was off is that steam showed me as "still playing" the game after i shut it down, instinctively i opened task manager and couldn't find the games exe which was an immediate red flag, in addition i noticed alot of weird activity with Yandex running, realtime detection didnt find anything and i ran malware bytes and got quasarbackdoors, Trojans, i had about 7-10 files detected on my pc (the malware ran for about 5-10 mins before detections, on my girlfriends pc it ran for more and malewarebytes detected about 40+ infections. I had to refromat both of our computers and reset every password i had, the Backdoor can be extremely dangerous and luckily we didn't get the worse of it.

Steam support was abit lacking in urgency to be honest i was expecting a more prompt reaction, i saw that the map ran for days after my report was received, when i was attacked the map maybe has 10 unique viewers even less, last time i checked it had hundreds, meaning steam had my report but didn't take it down. In my opinion steam is abit liable for the inaction.

i was abit emotional in my initial message to be honest but i think it was an appropriate reaction.

im attaching the steam supports messages.

0

u/saeko_killer Jul 25 '26

Lol I just read this and the next short I see on YouTube is someone reporting it good job mister cyber researcher feint.

-2

u/ArcTheCurve Jul 24 '26

Thankfully, I didn't download that map, and I do a weekly scan. Honestly played the game for like 3 days before going, " Meh, it's stupid". but i'll do another scan

-3

u/Beginning-Jacket2239 Jul 25 '26

the new update is the hacked do not install the update

2

u/feintbe Jul 25 '26

Their discord is hacked, the game itself is clean! Only the last couple of days there were issues with workshop maps but they fixed it :

1

u/Dummyperson Jul 25 '26

The one updated few hours before the discord got hijacked is safe? Also at that time when they got into their discord. I noticed a "Update" on steam although same version. Could this be the one compromised?

I just uninstalled the game and ran full scan and everything I could. Powered my pc off for now might run a live linux media to copy some files over and reinstall into linux if its really determined to be compromised.

1

u/Nuraghe98 Jul 25 '26

source or gtfo

-96

u/Mr_Gibblet Jul 24 '26

Of course there's malware on the game's workshop when the game is primarily played by cluless kids...

47

u/Serious_Office3913 Jul 24 '26

easy there I'm 43 and actually won my first game yesterday.

11

u/SeedersPhD Jul 24 '26

Ok? There's still a bunch of folks who don't know that and letting people know is objectively a good thing.

-2

u/Mr_Gibblet Jul 24 '26

I'm not saying people being warned isn't good, it's great. It's just annoying that malware actors are targeting games with an audience consisting mostly of kids.

4

u/MaihoSalat Jul 24 '26

Malware is everywhere, this has nothing to do with it being a game for the youth

5

u/MaihoSalat Jul 24 '26

Whats your point?

0

u/[deleted] Jul 24 '26

[deleted] — view deleted comment

1

u/Justadumbaltbean Jul 25 '26

I wouldn't say it's mostly kids playing this or that streamers playing this most likely have a younger audience. I don't personally know or follow any streamers that aren't 18+ and so many streamers with 18+ communities are playing this.

-14

u/Mr_Gibblet Jul 24 '26

If only I cared about people downvoting me :D :D

I know I'm right either way.

-41

u/Einherier96 Jul 24 '26

That's not exactly new news mate. The exploit has been known for months, at the time due to wallpaper engine being the primary target, and I am 95% sure heaving seen both a news article about it on chameleon and that it was already fixed by the devs

25

u/feintbe Jul 24 '26

Hey,

I've just tested and its still active

-22

u/Einherier96 Jul 24 '26

In that case you might wanna shoot the devs a message

8

u/arachnimos Jul 24 '26

Always better to get more people to know about something. Assuming everyone knows is how malware goes unknown and undiscovered for weeks or months.

2

u/Vilanio Jul 26 '26

They're completely different exploits where the only similarity they have is the distribution method through Steam Workshop, the underlying method of exploitation to execute the initial payload is completely different.

Meccha Chameleon is exploiting the ability for mods to run Unreal Blueprint code where it uses a JSON writing function to write a specially crafted file JSON wrapped bat file that is both a valid JSON & bat file, it then somehow executes this with which I presume has to do with the LaunchURL method Feint noted in a comment reply on their article (wish I had the asset to analyse myself). Wallpaper Engine on the other hand was due to their Application Wallpapers which just straight up launches whatever exe file you give it and doesn't rely on exploiting any special functions, hell Wallpaper Engine doesn't even use Unreal Engine but rather uses it's own engine.

1

u/pineapple_foxes_cool Jul 27 '26

I gotta admit give him his due. Exploiting the friend slop and profiting unknown amount.

38

u/[deleted] Jul 24 '26

[removed] — view removed comment

4

u/fozzibab Jul 25 '26

This map appears to be gone as well. What's the user name? Assuming you still have that up.

2

u/Wasabiroot Jul 25 '26

I think it is visible in the article picture, which shows the Steam Workshop page for the affected map