One of Steam’s biggest success stories of 2026 has suddenly found itself at the center of a security scare. A security researcher has discovered that a community-made Meccha Chameleon Workshop map contained code designed to write files outside the game and launch a hidden PowerShell process that attempted to download an additional payload from an external server.
How did a custom map become malware?
The investigation, published by security researcher Feint, began after players noticed a Command Prompt window briefly flashing on screen while Steam downloaded a custom Workshop map called Laser Tag Neon. Digging deeper, the researcher found that the map wasn’t hiding an executable file in the traditional sense. Instead, it abused Unreal Engine 5 Blueprint logic to write a batch file into the user’s Documents folder before launching a hidden PowerShell process.
According to the reverse engineering analysis, the script then attempted to download a second-stage batch file from a hardcoded external server and execute it. During testing, however, that download returned a 404 error, meaning the final payload was never retrieved and its intended purpose remains unknown. Even so, the behavior itself — writing executable files outside the game directory and invoking PowerShell — is highly unusual for a Workshop map and strongly suggests malicious intent.
The researcher stopped short of identifying the final malware family because the second-stage payload was unavailable during analysis. However, they concluded that the Workshop item should be treated as malicious based on multiple indicators, including hidden execution logic, disguised Blueprint assets, and attempts to retrieve external code.
Why this matters
Meccha Chameleon isn’t just another indie game. Since launching last month, the multiplayer hit has sold around 15 million copies, and industry analysts recently reported that it generated the second-highest PC game revenue of the month, behind only Fortnite. That massive audience makes it an attractive target for attackers looking to abuse community-created content.
Unlike installing a traditional mod manually, Workshop content is often downloaded automatically when joining multiplayer lobbies or subscribing to community maps. In this case, the malicious behavior was embedded inside what appeared to be a perfectly normal Unreal Engine asset, making it difficult to spot through a quick inspection.
Although the vulnerability has now been patched and the malicious Workshop map has been removed, the incident serves as a reminder to be cautious with community-created content. Gamers should stick to maps and mods from trusted creators, check community ratings and comments before downloading, keep their antivirus enabled, and ensure both Steam and their games are up to date. While most Workshop content is perfectly safe, this case shows that a single malicious upload can slip through and pose a security risk.
