Updated

Updated · Twisted Voxel · Jul 25

Meccha Chameleon Patches Workshop Flaw After Map Wrote s.bat, Tried 2-Stage Download

Updated

Updated · Twisted Voxel · Jul 25

Meccha Chameleon Patches Workshop Flaw After Map Wrote s.bat, Tried 2-Stage Download

Q: Since the malicious server went dark, what devastating payload was this disguised game map actually trying to unleash?

It is not known. The second-stage server was already returning HTTP 404 during analysis, so researchers could not recover the payload and could not verify what the map ultimately intended to deploy. What is confirmed is the delivery chain. The malicious Meccha Chameleon Workshop map, identified as “Laser Tag Neon” with Workshop ID 3765145606, reportedly wrote a file named `s.bat` into the Windows Documents folder, then launched hidden PowerShell with an execution-policy bypass and tried to fetch another batch file from an external server into `%TEMP%` and run it. That behavior is consistent with a downloader or loader, not a harmless map asset. Because the remote file was gone, any claim that it was definitely an infostealer, remote-access trojan, crypto miner, or account-stealing malware would be speculation. The reporting and technical write-ups only say the final payload is unknown. Security researchers have compared the risk profile to past Steam-hosted malware cases, where payloads have included backdoors, credential theft, and mining tools, but there is no evidence tying this specific map to one of those families. The practical takeaway is that the map was demonstrably malicious even without the missing second stage. Anyone who loaded it on Windows should treat the system as potentially exposed, remove the Workshop item, check for `Documents\s.bat`, review PowerShell and persistence activity, and run a full malware scan.

3 articles · Updated · Twisted Voxel · Jul 25

Meccha Chameleon’s developers patched a security issue after researcher Feint said a Steam Workshop map could act as a malware dropper.
Feint found a Blueprint that auto-ran on map load, wrote an “s.bat” file to the Windows Documents folder, then used PowerShell to fetch and run another script from a hardcoded server.
Testing on an affected PC confirmed the batch file was created, but the second-stage download did not execute because the remote server returned HTTP 404.
The map otherwise appeared to contain normal Unreal Engine 5 assets, underscoring how user-generated content can hide code paths unrelated to gameplay.
The case follows player reports of a flashing command prompt during map downloads and leaves the final payload unknown, even as the immediate flaw has been fixed.