If you queued into a MECCHA CHAMELEON Workshop map called Laser Tag Neon in late July, treat that session as a security event, not a funny neon arena. Independent researcher Feint documented the map as a malware dropper. The developers have since patched the Workshop path and say the base game on Steam is clean.
What Laser Tag Neon did
Laser Tag Neon (Steam Workshop ID 3765145606) looked like a normal Unreal Engine community map. Feint's breakdown found a Blueprint that ran when a match started. The chain:
Write a batch file (s.bat) into the user's Documents folder
Launch PowerShell with execution policy bypassed
Download and run a second-stage script from an external server
Later analysis tied that second stage to remote-access malware. Infection required loading the map in a match, not merely subscribing on the Workshop page. Steam removed Laser Tag Neon after disclosure. Copycat maps such as Chroma Grid Arena also appeared briefly and were pulled.
What the developers say is safe
On Steam, the team stressed that the shipped game files were not the vector:
To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.
In the same breach update, they explained how Discord got hit: while investigating the malicious MOD map, a system engineer's PC was infected; the attacker bypassed that engineer's Discord 2FA, seized permissions, and banned staff. They say the infected machine was a spare test PC that could not publish Steam game updates.
Patch status checklist
| Action | Detail |
|---|---|
| Update the game | Past 3.1.0 (devs say that build blocks unrelated-file execution; 3.2.0 notes reconfirm with Steam Support) |
| Workshop hygiene | Unsubscribe from unknown maps, especially neon/laser arenas from the incident window |
| If you launched Laser Tag Neon pre-patch | Scan Documents/temp for suspicious .bat files; run a full antivirus pass |
| Discord | Use only the restored official link posted on Steam news |
Ignore Discord DMs or posts claiming the Steam build itself ships a RAT and that you must run mystery cleanup scripts.
Confirmed vs rumor
| Claim | Status |
|---|---|
| Laser Tag Neon executed a dropper via Workshop Blueprint | Documented by Feint; map removed |
| Base Steam game embeds the virus | Denied by developers; Steam update pipeline still required for official builds |
| Discord was taken over during the response | Confirmed by Steam news; later restored |
| Patch landed in 3.1.0+ | Confirmed by developers |
Where to play safely
Get updates through Steam only. Prefer maps from creators with history, and treat brand-new Workshop uploads with skepticism. Follow the MECCHA CHAMELEON hub for later patch notes.