If you queued into a MECCHA CHAMELEON Workshop map called Laser Tag Neon in late July, treat that session as a security event, not a funny neon arena. Independent researcher Feint documented the map as a malware dropper. The developers have since patched the Workshop path and say the base game on Steam is clean.
What Laser Tag Neon did
Laser Tag Neon (Steam Workshop ID 3765145606) looked like a normal Unreal Engine community map. Feint's breakdown found a Blueprint that ran when a match started. The chain:
Write a batch file (s.bat) into the user's Documents folder
Launch PowerShell with execution policy bypassed
Download and run a second-stage script from an external server
Later analysis tied that second stage to remote-access malware. Infection required loading the map in a match, not merely subscribing on the Workshop page. Steam removed Laser Tag Neon after disclosure. Copycat maps such as Chroma Grid Arena also appeared briefly and were pulled.
What the developers say is safe
On Steam, the team stressed that the shipped game files were not the vector:
To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.
In the same breach update, they explained how Discord got hit: while investigating the malicious MOD map, a system engineer's PC was infected; the attacker bypassed that engineer's Discord 2FA, seized permissions, and banned staff. They say the infected machine was a spare test PC that could not publish Steam game updates.
Patch status checklist
| Action | Detail |
|---|
