This summer, the game Meccha Chameleon was released on PC via Steam. The indie online hide-and-seek game became a huge hit and quickly sold over 15 million copies.
In late July, players raised the alarm. Meccha Chameleon supports user-created maps that can be downloaded through the Steam Workshop. Some hackers noticed the popular project and started uploading maps with viruses.
Not only players themselves, but also developers began reporting the hack — the game's official Discord* server came under attack. Malicious actors started spreading false messages, claiming the game itself was infected.
Meccha Chameleon developers published a statement to players in the Steam community, explaining that the game itself is "100% SAFE and contains no viruses." According to them, the incident was limited to the compromise of one administrator account on Discord:
During the investigation and remediation of the malicious user map (mod) issue, a system engineer's computer was infected with malware. The hacker bypassed two-factor authentication (2FA) on Discord, gained control over server permissions, and banned all official staff.
The infected PC was a test machine, and hackers could not access Meccha Chameleon's source code or replace game files, so the game itself was not infected. Only players who downloaded and launched the infected map from the Steam Workshop are at risk.
- *(violates Russian Federation legislation)