A custom map for casual multiplayer game Meccha Chameleon potentially serves as a malware dropper, warns security researcher Feint.
A recent investigation published on Medium (via IntCyberDigest on Twitter/X) by security researcher Feint has raised concern about a Steam Workshop map created for Meccha Chameleon, alleging that it contains behavior consistent with a malware delivery chain. Although the game’s developers have since patched the reported security issue, the research highlights how custom content can be abused in unexpected ways.
The investigation began after several players noticed a command prompt window briefly flashing on screen while Steam downloaded a custom Workshop map through the game’s in-game lobby. Curious about the unusual behavior, the researcher analyzed the Workshop files and discovered that, despite appearing to contain only normal Unreal Engine 5 assets, one Blueprint performed actions unrelated to game content.
The report states that the Blueprint automatically executes when the map loads and constructs a path pointing to the player’s Windows Documents folder. It then writes a file named “s.bat” into that directory using Unreal Engine’s file-writing functionality. Rather than serving any obvious gameplay purpose, the batch file contains commands designed to relaunch itself before invoking PowerShell, attempting to download another batch script from a hardcoded external server, and then execute it.
To verify that this wasn’t merely theoretical, Feint examined an affected computer and confirmed that the batch file had indeed been written to the expected location. However, the report also notes that the second-stage download failed because the remote server returned an HTTP 404 error. As a result, no additional payload was retrieved or executed during testing, leaving the ultimate purpose of the external script unknown.
Even without the second stage, the researcher argues that the observed behavior is highly suspicious. The Blueprint’s only apparent function is writing a Windows command script outside the game directory and attempting to download and execute additional code from the internet.
While the developers have patched the reported vulnerability, Meccha Chameleon players are encouraged to remain cautious when downloading Workshop maps or other user-generated content.
