Downloaded a custom map for Meccha Chameleon recently? A researcher says it may have installed malware on your PC. - Windows Central

What the report says

Windows Central reported that a security researcher known as Feint alleged that at least one custom Steam Workshop map for the PC game Meccha Chameleon may have been designed to place malicious scripts on players’ Windows machines. The concern was raised after users noticed a command prompt briefly appearing while Steam automatically downloaded a workshop map during multiplayer lobby loading, according to the report.

The article says Feint found that the map appeared normal at first, using typical Unreal Engine 5 asset files, but contained a Blueprint actor hidden in the map metadata. The researcher said the Blueprint was set to run when the map loaded, create a batch file in the user’s Documents folder, and launch a hidden PowerShell process that attempted to contact an external server for another script. Feint’s test reportedly did not complete that download, leaving the intended payload unclear.

Windows Central said the suspect Workshop uploader account was new and had disabled comments and ratings, making user warnings harder to share. The article advised players who recently downloaded Meccha Chameleon Workshop maps to avoid new or unreviewed maps for now, scan their PCs with antivirus software, and check for unusual .bat files in the Documents folder. It also noted that responsibility had not been attributed to the game’s developers.

In an update dated July 25, 2026, Windows Central included a developer statement saying the game itself was “safe and virus-free” and that the incident was limited to a compromised Discord account belonging to an admin. The developers said an engineer’s spare testing PC was infected while investigating the malicious mod map issue, and warned players not to trust links or announcements from the compromised Discord server.