Meccha Cameleon Mod Maps Hit by Malware, Official Discord Server Hacked
The incident demonstrates how a mod map vulnerability in a popular game can cascade into a social platform breach, forcing developers to separate game security from account security in public messaging.
Key Facts
- Meccha Cameleon is a multiplayer hide-and-seek game released on June 10, with sales exceeding 15 million copies.
- Version 3.1.0, released on July 25 at 21:00, included a security patch for MOD maps that disabled arbitrary code execution.
- The official Discord server was hacked around 0:20 on July 26; the server creator's account was hijacked and all administrators were banned.
- Developer Lemorion stated the game itself is 100% virus-free and that the Discord breach was a separate account hijack, not a game vulnerability.
- Update 3.2.0, released on July 26, added 12 new emotes and reiterated that game safety has been resolved.
Reporting from 3 sources: ASCII.jp, Denfaminicogamer, Game Spark.
On July 25 and 26, the multiplayer hide-and-seek game Meccha Cameleon faced a security incident that began with malware found in user-made mod maps on Steam Workshop and escalated into a hack of its official Discord server. Developers Lemorion and Haganeiro reported that the malware issue was addressed with a security patch in version 3.1.0, released on July 25 at 21:00, which disabled arbitrary code execution in mod maps. However, shortly after the fix, the official Discord server was compromised. The server creator's account was hijacked, all administrators were banned, and the hacker posted messages impersonating the DedSec group from Watch Dogs. Lemorion stated that the game itself is 100% virus-free and that the Discord breach was a separate incident involving a hijacked administrator account, not a game vulnerability. The developer confirmed that the infected PC used for verification was a spare, not a development machine, and has been fully reset. Update 3.2.0, released on July 26, added 12 new emotes and reiterated that game safety has been resolved. Discord support has been contacted, and the server is expected to be restored within 48 hours as of July 26.
The security incident at Meccha Cameleon began when users reported that downloading certain mod maps from Steam Workshop triggered a command prompt window, suggesting malware execution. Developer Haganeiro verified the arbitrary code execution in-game and confirmed that the fix in version 3.1.0, released at 21:00 on July 25, disabled the vulnerability. The patch notes listed a 'Security patch for MOD maps' alongside a collaboration map with Garten of Banban.
Hours later, the official Discord server was hacked. The server creator's account was hijacked, all administrators were banned, and the attacker posted messages mimicking the DedSec hacker group from Watch Dogs. Lemorion recommended that users temporarily leave the server and avoid clicking suspicious links. The developer emphasized that the game and Discord are not linked, and that the breach was a Discord account hijack, not a game infection. The PC used to verify the malware was a spare, not a development environment, and has been completely reset.
Update 3.2.0, released on July 26, added 12 new emotes including 'orz' and a handstand pose. Lemorion stated that game safety has been confirmed with Steam support and that mod maps are safe to use. The Discord server is expected to be restored within 48 hours as of July 26.
Synthesized by Yomimono from the 3 cited sources below, including Japanese-language reporting where cited, then editorially reviewed before publishing.