Video Summary - The Meccha Chameleon Malware Incident

Summary of the “Mecha Chameleon” Malware Incident

The video discusses Mecha Chameleon, a popular hide-and-seek game with custom maps distributed via Steam Workshop.
The core concern is that mods/mappings from Workshop can be abused, despite Steam being relatively more trusted than other mod sources.

While testing a specific Workshop map (example: “Laser Tag Neon”), a researcher’s friend observed a command prompt window briefly appearing after downloading/running the mod—an ominous sign that malware may have executed.
The researcher then inspected the Workshop files:
- The file structure appeared normal at first (e.g., UE5-related assets and no obvious fake executables).
- The key indicator was in the Unreal Engine metadata, especially a suspicious entry in Asset registry.bin.
  - The naming pattern was described as consistent with attempts aligned to remote code execution (RCE) behavior.

The malicious content appears to leverage Unreal Engine scripting/metadata to trigger PowerShell/CMD-based payloads.
A staged workflow is described:
1. Embedded logic drops/creates a batch file in a local directory.
2. That batch file triggers a second stage using PowerShell with a hidden window and an execution-policy bypass.
3. The second stage then makes a web request to pull additional scripts/payloads.
  - The description includes downloading and saving a steam.bat, then executing a further stage.
The researcher notes the second-stage payload was taken down by the time they analyzed it further, limiting confirmation of the full end-to-end chain.

The video claims a developer (referenced as Hage Nero) posted an update saying the custom-map vulnerability was fixed, with a rapid turnaround (“same day”).
The host emphasizes that patched systems still aren’t 100% safe, because attackers may attempt other exploitation or execution paths.

After the initial incident, claims spread on Discord that:
- the game/server or developer accounts were compromised, and
- a specific game update (3.10.0) included a confirmed remote code execution vulnerability.
The host’s investigation argues these claims are misinformation/hoax, not evidence of a real compromise:
- They performed (or planned) static analysis in a VM and checked behavior.
- They compared update notes and file types and found no strong technical indicators the update itself was “ratted.”
- Behavioral monitoring (e.g., Procmon/Steam process activity) reportedly did not show the expected PowerShell/CMD malware actions during normal play in a controlled environment.
The host concludes:
- The Discord (or a Discord server) was compromised, not the actual game/update.
- The spread of false warnings is portrayed as an attempt to cause panic, manipulate players, and possibly set up follow-on attacks.

The host suggests attackers likely:
- used the malicious mod as the true entry point (RAT-stage chain),
- then leveraged Discord takeover/messaging to increase fear and prompt victims into harmful actions (e.g., advice to “reinstall Windows”) or to spread rumors that confuse defenses.
The host also notes the attacker’s conduct (publicly announcing blame or self-claims) is uncharacteristic of typical RAT campaigns—supporting the “hoax/messaging manipulation” interpretation.

Malicious mod: likely true (RAT delivered via Workshop content).
Game update: likely not malicious, despite the claims.
If infected (i.e., if the second stage executed and the attacker’s scripts ran): the host suggests the “reinstall Windows” guidance could be appropriate.
The host advises players to avoid the compromised Discord and generally notes that modding ecosystems remain risky.