A Steam Workshop item for Meccha Chameleon named Laser Tag Neon should be treated as malicious. The item is Workshop ID 3765145606. A researcher recovered Blueprint logic that writes %USERPROFILE%\Documents\s.bat, then attempts to use hidden PowerShell to download another batch file and run it. The second stage returned HTTP 404 on the affected PC that was examined, so its contents and final impact remain unknown. If you loaded this map on Windows, unsubscribe from it, close the game and Steam, preserve evidence if needed, and scan the PC before signing back into important accounts.
Which Meccha Chameleon map is malicious?
The confirmed item is Laser Tag Neon at steamcommunity.com/sharedfiles/filedetails/?id=3765145606. The public Steam listing still showed the item and 756 current subscribers when Gridinsoft checked it on July 24, 2026. The listing alone does not reveal the hidden behavior: it presents a normal-looking blue-neon laser-tag arena.
This finding does not mean that the base game or every Workshop map is malware. It means one named item contains a file-writing and second-stage download chain that has no legitimate reason to be inside a map. Steam and the game developer may remove or change the listing after this article is published, so use the item ID rather than relying only on its display name.
| Finding | What it means |
|---|---|
Blueprint logic runs through ReceiveBeginPlay |
The relevant logic is tied to the map loading, not to a button the player intentionally presses. |
The map writes s.bat into the user’s Documents folder |
The item attempts to create an executable script outside the game directory. |
| The script starts hidden PowerShell and requests another batch file | The Workshop package acts as a downloader rather than containing the final payload itself. |
| The remote request returned HTTP 404 on the examined PC | The second stage did not run in that documented case; its malware family and intended impact are unknown. |
| The item was still public when checked | Players should identify it by ID, unsubscribe, and assess whether the map was actually loaded on Windows. |
How the Workshop malware chain works
The primary analysis found one custom Blueprint with references including GetPlatformUserDir, ToFile, and powershell. Its older embedded actor name, BP_RCE_Test_C_0, remained visible even though the class appeared under an ambient-controller name. The recovered bytecode and string data describe this chain:[1]
- When the map begins loading, its Blueprint obtains the current Windows user directory.
- It writes a JSON/batch polyglot to
%USERPROFILE%\Documents\s.bat. - The script relaunches itself in a minimized command window, then starts PowerShell with a hidden window and a process-level execution-policy bypass.
- PowerShell attempts to save a remote
steamb.batfile as%TEMP%\s.batand execute it.
A separate June investigation had already demonstrated why this route was possible: Meccha Chameleon Workshop maps could contain Unreal Engine Blueprint logic and use a predictable Workshop path to launch a planted file. That researcher reported the original arbitrary-file issue as patched, but the later Laser Tag Neon analysis shows a different file-writing path embedded in map assets.[2]
The important evidence limit is the missing second stage. On the affected machine described in the July analysis, PowerShell logged an HTTP 404 response. The downloaded file was not present, and nothing was available to classify as an infostealer, RAT, or another family. A different player could have reached the server at a different time, but claiming data theft without host evidence would be speculation.
How to tell whether your Windows PC was exposed
Use the following states to decide how far the response should go:
- You only saw the Workshop page: viewing the listing is not the same as loading the map. Do not subscribe. No malware cleanup is indicated from the page view alone.
- You subscribed but never loaded or joined a lobby using the map: unsubscribe and remove the item’s local folder. A precautionary scan is reasonable, especially if Steam had already downloaded the content, but the researched trigger is associated with map loading.
- You loaded Laser Tag Neon on Windows or saw a brief command window: treat the PC as exposed. Do not open any
s.batfile to inspect it. Follow the containment and scan steps below. - You find unexpected PowerShell activity, a downloaded second stage, persistence, or account alerts: treat this as a possible compromise. Preserve evidence if it matters, disconnect the PC from the network, and rotate exposed credentials from a clean device.
The demonstrated chain uses Windows paths, batch files, and PowerShell. The research did not show the same chain executing natively on macOS. That is a platform boundary, not a general guarantee that every Workshop item is safe on Mac, Linux, or Steam Deck.
Remove Laser Tag Neon and check the PC
- Disconnect if activity is continuing. If a command window keeps returning, PowerShell is active, or new account alerts are arriving, take the Windows PC offline before cleanup.
- Unsubscribe from Workshop item 3765145606. Close Meccha Chameleon and Steam first. Open the item’s Workshop page, confirm the ID in the address, and unsubscribe. Do not launch the map again to test it.
- Preserve evidence when necessary. Before deleting files, an administrator or incident responder may need the Workshop folder,
s.bathash, PowerShell Operational log, process history, and relevant timestamps. Do not upload samples to public forums. - Remove the local Workshop folder. After Steam is closed and any required evidence is preserved, remove the item directory shown below. Never double-click scripts inside it or in Documents/Temp.
C:\Program Files (x86)\Steam\steamapps\workshop\content\4704690\3765145606\
%USERPROFILE%\Documents\s.bat
%TEMP%\s.bat
Scan Windows and check for persistence
Unsubscribing removes the Workshop item, but it cannot prove that a script, downloaded second stage, scheduled task, service, startup entry, security exclusion, or other persistence was not created while the map loaded. Run a full Gridinsoft Anti-Malware scan, remove confirmed detections, reboot, and scan again if symptoms return. Then review recent PowerShell activity, Task Scheduler, startup apps, services, browser extensions, and security exclusions. The Windows security audit checklist provides the wider post-malware review.
Loaders, trainers, and game hack tools can fetch extra code after launch. Deleting the visible file may not remove helpers, scheduled tasks, Defender exclusions, or account-stealing components.
Scan this Windows PCIf a suspicious file was downloaded or executed, use the account-response sequence in our game and mod infostealer guide: change Steam, email, and other exposed passwords from a clean device; revoke active sessions; enable Steam Guard or another strong second factor; and monitor payment methods. Do not rotate credentials on a PC that may still be compromised.
After containment, use Steam’s Verify integrity of game files option for Meccha Chameleon. Verification repairs the base game; it does not replace unsubscribing from the Workshop item or scanning files written outside the game directory. For another example of malicious Steam user-generated content, see the Wallpaper Engine Workshop cleanup guide.
Indicators from the published analysis
These indicators are for identification and incident response. The network address is defanged and should not be visited.
Steam AppID: 4704690
Workshop item: 3765145606
Map name: Laser Tag Neon
Dropped script: %USERPROFILE%\Documents\s.bat
Attempted second stage: %TEMP%\s.bat
Defanged request: hxxp://31[.]57[.]34[.]228/work/steamb.bat
s.bat SHA-256:
1ff540bc3c493a93059e602b414ba61027ed1a2b8a079f6197b0718f4a2101b6
UTOC SHA-256:
aea429fbb44d552c917c22018e838e4154e68a8cac5806f7a8e30b61586ba2a6
UCAS SHA-256:
fbd932faba4ec8d614fbd7a68636e177213259bafe2babdcdc47c2a8acd6d569
PAK SHA-256:
aa58f9061a4e39e3f5a28395c56cfa5b0072d90e66054894f9c8022e81e396c9
Hashes identify the analyzed build, not every future version of the listing. If Steam or the uploader replaces the content, the files and hashes may change.
FAQ
Is Meccha Chameleon malware?
The evidence concerns one named Workshop item, Laser Tag Neon, not the entire base game. Treat item 3765145606 as malicious and avoid generalizing that verdict to every map without evidence.
Did the Laser Tag Neon second-stage malware run?
Not on the affected PC documented by the researcher. The PowerShell download returned HTTP 404, so the second batch file was not written or executed in that case. Other systems or earlier times require host evidence.
Is unsubscribing from the map enough?
No, if the map was loaded on Windows. Unsubscribing prevents Steam from keeping the item, but it does not remove a script already written outside the Workshop folder or any later persistence. Scan the PC and review recent system changes.
Should I reinstall Windows?
Not by default. Start with containment, evidence preservation, a full scan, persistence checks, and account review. Reinstall from trusted media when a confirmed payload cannot be removed, system integrity is uncertain, or an incident-response requirement calls for it.
Are Mac and Steam Deck players affected?
The demonstrated dropper uses Windows batch files and PowerShell, and the published analysis did not show native execution on macOS. That does not prove all Workshop content is safe on other platforms, and Windows compatibility layers can change the practical exposure.
References
- Feint. “Workshop map for MECCHA CHAMELEON is a malware dropper (full breakdown).” Medium, July 24, 2026; accessed July 24, 2026. Primary reverse-engineering analysis.
- Khael Kugler. “2-Click Remote Code Execution in Meccha Chameleon.” June 21, 2026; accessed July 24, 2026. Independent Workshop RCE research.
- Valve Corporation. “Steam Workshop: Laser Tag Neon, item 3765145606.” Steam Community; accessed July 24, 2026. Official public Workshop listing.
