The most popular indie game on Steam recently experienced a malware scare.

      A Meccha Chameleon Workshop map was discovered trying to execute code beyond the game.

      One of the biggest success stories on Steam in 2026 is now facing a security crisis. A security researcher has uncovered that a community-created Meccha Chameleon Workshop map included code intended to write files outside of the game and initiate a concealed PowerShell process to download an additional payload from an external server.

      How did a custom map turn into malware?

      The investigation, conducted by security researcher Feint, began when players observed a Command Prompt window momentarily appearing while Steam was downloading a custom Workshop map called Laser Tag Neon. Upon further exploration, the researcher found that the map did not conceal an executable file in the usual manner. Instead, it exploited Unreal Engine 5 Blueprint logic to create a batch file in the user’s Documents folder, followed by launching a hidden PowerShell process.

      The Laser Tag Neon map on Steam (now removed) Steam Community

      Per the reverse engineering analysis, the script then attempted to download a second-stage batch file from a hardcoded external server to execute it. However, during testing, that download produced a 404 error, indicating that the final payload was never obtained, leaving its intended function unclear. Nevertheless, the behavior itself—writing executable files outside the game directory and invoking PowerShell—is distinctly atypical for a Workshop map and strongly indicates malicious intent.

      The researcher refrained from categorizing the final malware family due to the unavailability of the second-stage payload during the analysis. However, they determined that the Workshop item should be treated as malicious based on several indicators, such as concealed execution logic, camouflaged Blueprint assets, and attempts to retrieve external code.

      Why is this significant?

      Meccha Chameleon is not just another indie game. Since its launch last month, the multiplayer sensation has sold roughly 15 million copies, and industry analysts recently indicated that it racked up the second-highest PC game revenue of the month, second only to Fortnite. This large player base makes it an appealing target for attackers looking to exploit community-created content.

      lemorion_1224

      In contrast to manually installing a traditional mod, Workshop content is often downloaded automatically when joining multiplayer sessions or subscribing to community maps. In this situation, the malicious activity was concealed within what appeared to be a normal Unreal Engine asset, making it challenging to detect during a cursory inspection.

      Though the vulnerability has been patched and the harmful Workshop map has been removed, this incident serves as a reminder to exercise caution with community-generated content. Gamers should rely on maps and mods from reputable creators, review community ratings and comments before downloading, keep their antivirus software active, and ensure both Steam and their games are up to date. While most Workshop content is completely safe, this case illustrates that a single malicious upload can evade detection and become a security threat.

      Varun is an experienced technology journalist and editor with over eight years of experience in consumer tech media. His work encompasses...

      Lenovo’s $99 280Hz gaming monitor is targeted at budget-conscious consumers

      Lenovo is offering a 280Hz monitor for less than GTA 6 Ultimate Edition

      After recently launching a metallic Hall-effect keyboard and a 59g gaming mouse for stylish esports setups, Lenovo is now focusing on gamers with tighter budgets. The Legion 24-1r appears to cater to financially strapped college students who splurged on their first gaming rig and now rely on instant noodles for most meals. Priced at just 669 yuan (approximately $99), it features a 23.8-inch IPS panel capable of running at up to 280Hz.

      Lenovo is also releasing a 27-inch Legion 27-1r with similar core specs for 789 yuan, or around $116. For budget-conscious gamers seeking competitive frame rates, both options seem like extremely appealing deals. (via NotebookCheck)

      I played Halo: Campaign Evolved, and its cinematics reveal what the Halo series could have been

      Halo’s remake appears poised for Hollywood. So where’s the show it deserves?

      At one point early in Halo: Campaign Evolved, I momentarily stopped perceiving the remake as simply a game. I was engrossed in one of its newly revamped cutscenes. Master Chief, Captain Keyes, Cortana, the Pillar of Autumn, and the enormous scale of their surroundings suddenly felt much more cinematic than ever before.

      Having played the original Halo: Combat Evolved in the early 2000s, I felt as though this was precisely how it appeared and felt. The first Halo title introduced me to intergalactic warfare well before Star Wars, and the cinematic adds just enough subtle enhancements to elevate Bungie’s original work from decades ago.

      Xbox is addressing one of the main frustrations with the PC app regarding download speeds

      A new Smart Download Client aims to provide faster, more consistent download speeds for games and updates.

      Waiting for a massive Game Pass download to complete may soon become less excruci