MECCHA CHAMELEON Laser Tag Neon malware: what to do

If you queued into a MECCHA CHAMELEON Workshop map called Laser Tag Neon in late July, treat that session as a security event, not a funny neon arena. Independent researcher Feint documented the map as a malware dropper. The developers have since patched the Workshop path and say the base game on Steam is clean.

What Laser Tag Neon did

Laser Tag Neon (Steam Workshop ID 3765145606) looked like a normal Unreal Engine community map. Feint's breakdown found a Blueprint that ran when a match started. The chain:

Write a batch file (s.bat) into the user's Documents folder

Launch PowerShell with execution policy bypassed

Download and run a second-stage script from an external server

Later analysis tied that second stage to remote-access malware. Infection required loading the map in a match, not merely subscribing on the Workshop page. Steam removed Laser Tag Neon after disclosure. Copycat maps such as Chroma Grid Arena also appeared briefly and were pulled.

MECCHA CHAMELEON, the Steam hit whose Workshop maps were abused

What the developers say is safe

On Steam, the team stressed that the shipped game files were not the vector:

To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.

In the same breach update, they explained how Discord got hit: while investigating the malicious MOD map, a system engineer's PC was infected; the attacker bypassed that engineer's Discord 2FA, seized permissions, and banned staff. They say the infected machine was a spare test PC that could not publish Steam game updates.

Painting and blending is the fantasy. Malicious Workshop Blueprints were the real risk.

Patch status checklist

Action | Detail
Update the game | Past 3.1.0 (devs say that build blocks unrelated-file execution; 3.2.0 notes reconfirm with Steam Support)
Workshop hygiene | Unsubscribe from unknown maps, especially neon/laser arenas from the incident window
If you launched Laser Tag Neon pre-patch | Scan Documents/temp for suspicious .bat files; run a full antivirus pass
Discord | Use only the restored official link posted on Steam news

Ignore Discord DMs or posts claiming the Steam build itself ships a RAT and that you must run mystery cleanup scripts.

Stick to verified maps until you are on a patched build

Confirmed vs rumor

Claim | Status
Laser Tag Neon executed a dropper via Workshop Blueprint | Documented by Feint; map removed
Base Steam game embeds the virus | Denied by developers; Steam update pipeline still required for official builds
Discord was taken over during the response | Confirmed by Steam news; later restored
Patch landed in 3.1.0+ | Confirmed by developers

Where to play safely

Get updates through Steam only. Prefer maps from creators with history, and treat brand-new Workshop uploads with skepticism. Follow the MECCHA CHAMELEON hub for later patch notes.