Updated

Updated · Windows Central · Jul 25

Meccha Chameleon Says Game Is 100% Safe After 1 Discord Admin Account Was Hijacked

Updated

Updated · Windows Central · Jul 25

Meccha Chameleon Says Game Is 100% Safe After 1 Discord Admin Account Was Hijacked

Q: How did one infected engineer’s PC reportedly lead to a full Discord takeover despite two-factor authentication?

The reported takeover likely happened because the malware compromised the engineer’s active Discord session or device-level access, not just their password. In that scenario, two-factor authentication would offer limited protection: if an attacker steals session tokens, cookies, or gains remote control of a logged-in machine, they can act as the user without needing to trigger a fresh 2FA challenge. That aligns with the developer’s account that the engineer’s infected PC let the hacker “bypass” 2FA. In practice, this usually means the attacker inherited an already authenticated Discord account or used malware to approve or intercept authentication on the compromised system. Security researchers have long noted that Discord account hijacks often work this way, through token theft or remote access, rather than by cracking passwords. Once inside a staff account with high privileges, the attacker could change server permissions, hide channels, remove or ban other admins, and lock the team out. The developers said exactly that happened: permissions were altered and staff members were banned, which is how a single compromised moderator or engineer account can turn into a full server takeover. The breach appears separate from the game itself. The studio says Meccha Chameleon and patch 3.1.0 remain safe, and that Steam’s publishing system would prevent a Discord compromise alone from being used to push a malicious game update.

3 articles · Updated · Windows Central · Jul 25

Meccha Chameleon developers said the breach was confined to one Discord admin account and that the game itself is “100% safe and virus-free.”
A system engineer’s spare testing PC was infected while the team investigated and patched a malicious mod map issue, letting an attacker bypass Discord 2FA, seize server permissions and ban official staff.
Logs showed the compromised machine could not access or alter game source files, the studio said, and the PC has already been wiped and reformatted.
Players were warned the hijacker may keep posting fake announcements on the Discord server and were told not to click links, join replacement servers or follow instructions there.
The incident follows reports that some Steam Workshop maps for the indie PC game were rigged to drop malware onto players’ Windows systems.