The year’s breakout Steam hit has picked up an unwanted feature: a way for hackers to hijack your PC. Security researchers found that several community-made maps for Meccha Chameleon, distributed through Steam Workshop, carried a malicious payload capable of installing a Remote Access Trojan (RAT) on players’ machines.
The mechanics are grimly familiar. A RAT does exactly what the name suggests — it hands an attacker remote control of the infected system. That means keystroke logging, file exfiltration, webcam access and the ability to run further commands, all while the victim thinks they’re just loading a fan-made level. Because Steam Workshop content downloads and executes in the background when you subscribe, a booby-trapped map needs very little help from the user to do damage.
What makes this one sting is the sheer size of the target audience. Meccha Chameleon is the standout Steam indie success of 2026, having moved more than 15 million copies since it launched on June 10, 2026. Built by Japanese solo developer lemorion_1224 and priced at just US$5.99, it rode a wave of word-of-mouth into millions of libraries — and that popularity is precisely what made its Workshop such an attractive delivery channel for malware. When a game sells at that scale, even a small fraction of exposed players adds up to a large pool of compromised PCs.
The game itself is undemanding, which only widened the blast radius. Its minimum requirements are modest: Windows 10 64-bit, an Intel Core i5 processor and a graphics card compatible with DirectX 11 or DirectX 12. In other words, it runs on almost anything, so almost anyone could be affected.
If you play Meccha Chameleon with community maps, a few precautions are worth taking right now:
- Audit your Workshop subscriptions and unsubscribe from any recently added maps you don’t recognize or trust.
- Run a full antivirus and anti-malware scan — RATs are designed to stay hidden, so a manual check-up is worthwhile.
- Watch for odd behavior: unexpected network activity, unfamiliar processes or a webcam light that flicks on by itself.
- Change important passwords from a clean device if you suspect infection, since credential theft is a RAT’s bread and butter.
The broader lesson isn’t about one game. User-generated content platforms like Steam Workshop are convenient by design — subscribe and go — and that frictionlessness is exactly the gap attackers exploit. Popularity is a magnet for abuse, and the biggest game of the year is, inevitably, the biggest bullseye too.
