Updated

Updated · Windows Central · Jul 24

Meccha Chameleon Workshop Maps Drop Malware on Windows PCs via Hidden Blueprint Script

Updated

Updated · Windows Central · Jul 24

Meccha Chameleon Workshop Maps Drop Malware on Windows PCs via Hidden Blueprint Script

Q: Since the malicious server went dark, what devastating payload was this disguised game map actually trying to unleash?

It is not known. The second-stage server was already returning HTTP 404 during analysis, so researchers could not recover the payload and could not verify what the map ultimately intended to deploy. What is confirmed is the delivery chain. The malicious Meccha Chameleon Workshop map, identified as “Laser Tag Neon” with Workshop ID 3765145606, reportedly wrote a file named `s.bat` into the Windows Documents folder, then launched hidden PowerShell with an execution-policy bypass and tried to fetch another batch file from an external server into `%TEMP%` and run it. That behavior is consistent with a downloader or loader, not a harmless map asset. Because the remote file was gone, any claim that it was definitely an infostealer, remote-access trojan, crypto miner, or account-stealing malware would be speculation. The reporting and technical write-ups only say the final payload is unknown. Security researchers have compared the risk profile to past Steam-hosted malware cases, where payloads have included backdoors, credential theft, and mining tools, but there is no evidence tying this specific map to one of those families. The practical takeaway is that the map was demonstrably malicious even without the missing second stage. Anyone who loaded it on Windows should treat the system as potentially exposed, remove the Workshop item, check for `Documents\s.bat`, review PowerShell and persistence activity, and run a full malware scan.

3 articles · Updated · Windows Central · Jul 24

Feint found some Meccha Chameleon Steam Workshop maps can automatically plant malware on Windows PCs when the map loads, after users join lobbies that trigger the download.
A hidden Unreal Engine Blueprint actor writes a .bat file into the Documents folder, then launches a concealed PowerShell process with execution-policy bypass to fetch a second script from an external server.
The payload Feint tested did not fully download, but the researcher said any map that writes and executes scripts outside the game folder is a clear malware sign.
One uploader account was only about a week old and had comments and ratings disabled; the map has been reported to Steam, but Valve had not confirmed removal.
Players are being urged to avoid new Meccha Chameleon maps, scan their PCs, and check Documents for suspicious .bat files after a separate Steam malware incident involving Wallpaper Engine last month.