One of Steam’s biggest success stories of 2026 has found itself at the center of a security scare. A security researcher discovered that the publicly released Meccha Chameleon Workshop map contained code designed to write files outside of the game and launch a hidden PowerShell process that attempted to download another payload from an external server.
How did custom map become malware?
The investigation, published by security researcher Feint, began after players saw a Command Prompt window flash briefly on the screen while Steam was downloading a custom Workshop map called Laser Tag Neon. Digging deeper, the researcher discovered that the map was not hiding an executable file in the traditional sense. Instead, it used Unreal Engine 5 Blueprint logic to write a batch file to the user’s documents folder before launching a hidden PowerShell process.
According to the reverse engineering analysis, the script then tries to download the batch file of the second phase from the hard-coded external server and executes it. During testing, however, that download returned a 404 error, meaning that the last payment was never returned and its purpose is unknown. However, the behavior itself – writing executable files outside of the game directory and invoking PowerShell – is very unusual for a working map and strongly suggests malicious intent.
The researcher stopped identifying the last malware family because the second stage payload was not available at the time of analysis. However, they concluded that the Workshop object should be treated as malicious based on several indicators, including a hidden method of execution, hidden Blueprint assets, and attempts to find foreign code.
Why is this important?
Meccha Chameleon is not just another indie game. Since its launch last month, the multiplayer hit has sold nearly 15 million copies, and industry analysts recently reported that it generated the second highest revenue for a PC game of the month, behind only Fortnite. That large audience makes it an attractive target for attackers looking to abuse community-created content.
Unlike manually installing a custom mod, Workshop content is usually downloaded automatically when you join multiplayer portals or sign up for community maps. In this case, the malicious behavior is embedded within what appears to be a standard Unreal Engine property, making it difficult to spot by quick inspection.
Although the vulnerability has been removed and the malicious Workshop map has been removed, the incident serves as a reminder to be cautious with community-generated content. Gamers should stick to maps and routes from trusted creators, check community ratings and comments before downloading, keep their antivirus enabled, and make sure both Steam and their games are up to date. While most Workshop content is completely safe, this case shows that a single malicious upload can create a security risk.
