User-made maps from Steam top-seller Meccha Chameleon have been found to contain malware, just as the game's official Discord server got hacked - Eurogamer.net

What the report says

Eurogamer reported that Meccha Chameleon, a popular indie prop-hunt game on Steam, faced two linked security problems over the same weekend: malware was found in user-made Steam Workshop maps, and the game’s official Discord server was compromised. The issue was first raised Thursday by an independent researcher using the name Feint, who examined a Workshop map after a player noticed a command prompt briefly appearing during download.

According to Eurogamer’s account, Feint’s analysis found what appeared to be a malware dropper inside the map Laser Tag Neon. That map was removed after the findings became public, but another allegedly infected map, Chroma Grid Arena, was later identified and also appears to have been taken down. The game’s developer, Lemorion_1224, posted updates on Steam saying the base game itself was not infected.

The developer also said false claims about a remote-access trojan in the latest official update came from the party responsible for the Discord incident. Lemorion_1224 said a single admin account was compromised after a system engineer’s computer was infected while the team was investigating the malicious map problem, allowing the attacker to bypass Discord two-factor authentication, seize server permissions and remove official staff.

Eurogamer said the developer released version 3.1.0 on Saturday to close the vulnerability that allowed Workshop maps to run malware and to fix bugs. Feint’s post advised players who launched affected maps before updating to run a full malware scan and check for signs of compromise. The official Discord was later restored, according to the developer. The case highlights the security risks that can arise around user-generated mod content on large PC gaming platforms.