Malicious Steam workshop map delivered malware to MECCHA CHAMELEON players

As outlined in Cyber Insider, a malicious Steam Workshop map for the game MECCHA CHAMELEON exploited a vulnerability in the game's mod-loading system to deliver malware to players' computers. The developers have since released an update to fix the issue, and Steam has removed the malicious maps.

The attack was discovered by reverse engineer Feint, who observed a Command Prompt window flashing on players' PCs when loading a specific Workshop map. Analysis revealed a hidden Unreal Engine Blueprint that executed automatically, creating a batch file that downloaded and executed a second-stage payload. This payload installed a Remote Access Trojan (RAT), allowing attackers to gain remote control of compromised systems. The malware also compromised a testing machine belonging to a MECCHA CHAMELEON system engineer, leading to the hijacking of an administrator account on the game's Discord server. This incident follows a similar campaign in June where malicious Wallpaper Engine "application wallpapers" on Steam Workshop delivered various types of malware. The MECCHA CHAMELEON developers released version 3.1.0 to patch the vulnerability, and Steam removed the malicious maps. Users who may have launched the affected maps are advised to perform malware scans and review their systems for suspicious files and startup entries.

Source: Cyber Insider