Two days ago, Reddit user FeintBe discovered that several custom Meccha Chameleon maps on the Steam Workshop were hosting malware delivery chains. They posted an extensive breakdown of their findings to Medium, prompting an investigation from developer Lemorion, which soon spiraled into a Discord breach as the team found themselves the victim to those same bad faith actors.
"The game itself is not affected," Lemorion posted to Steam yesterday. "Currently, the official Meccha Chameleon Discord server has been hacked, and we are completely unable to take any action on our end. We have already contacted Discord Support and are currently awaiting their response. If the server cannot be recovered, we will set up a new one."
With control firmly in the hands of the hacker, false statements were issued on the server claiming that the latest update contained a remote access trojan and that users must complete specific steps to fix it. "We have never implemented anything of the sort," Lemorion clarified. "This statement was made solely to cause panic and mislead players. Even if a hacker attempted to modify the game, Steam's developer infrastructure prevents anyone from publishing a game update simply by compromising a PC."
So, how did...
