Players of indie game Meccha Chameleon have been advised to install the latest update and avoid the game's original Discord community after malicious Steam Workshop maps were found to contain malware capable of compromising users' computers.
The security issue was initially investigated by independent researcher Feint after players reported unusual black windows appearing briefly while custom maps were being loaded. According to a report by Dexerto, Feint identified one of the problematic maps as "Laser Tag Neon." Loading the map caused a hidden file to be placed on the user's computer.
The hidden file was reportedly designed to connect to the internet and retrieve additional malware. Although "Laser Tag Neon" was eventually removed, another map called "Chroma Grid Arena" was reportedly found carrying similar malicious content.
Feint's investigation suggested that the second-stage malware could provide attackers with persistent remote access to affected machines. However, players were not compromised merely by downloading the maps. They needed to actually load and play the malicious content for the infection to take place.
Meccha Chameleon co-developer Haganeiro said the vulnerability was addressed in update 3.1.0. The developers also took steps to deactivate the malicious code within affected maps, including for users who had not yet installed the update.
The incident nevertheless escalated when a systems engineer helping the developers investigate the malware reportedly had a backup computer compromised. According to Dexerto, attackers subsequently used the infected machine to gain access to the engineer's Discord account.
Per Developer LEMORION, the attackers then changed permissions on the game's official Discord server and banned members of the development team. The server has approximately 100,000 members.
The developers said the compromised computer did not have access to Meccha Chameleon's source code, game files or Steam developer accounts. Reports suggesting that attackers had used the Discord takeover to compromise the game's official build were also disputed.
A new community Discord server has since been created as the developers wait for Discord's support team to respond to the incident.
Read the original article: