The hottest indie game on Steam just had a malware scare

The hottest indie game on Steam just had a malware scare should be explained through that lens before any broad claim is made. One of Steam’s biggest success stories of 2026 has suddenly found itself at the center of a security scare. The investigation, published by security researcher Feint , began after players noticed a Command Prompt window briefly flashing on screen while Steam downloaded a custom Workshop map called Laser Tag Neon. The piece keeps the context, impact, and follow-up signals in view so readers do not stop at the headline.

What happened

One of Steam’s biggest success stories of 2026 has suddenly found itself at the center of a security scare. A security researcher has discovered that a community-made Meccha Chameleon Workshop map contained code designed to write files outside the game and launch a hidden PowerShell process that attempted to download an additional payload from an external server.

Practical impact for readers

The investigation, published by security researcher Feint , began after players noticed a Command Prompt window briefly flashing on screen while Steam downloaded a custom Workshop map called Laser Tag Neon. Digging deeper, the researcher found that the map wasn’t hiding an executable file in the traditional sense. Instead, it abused Unreal Engine 5 Blueprint logic to write a batch file into the user’s Documents folder before launching a hidden PowerShell process.

Details worth verifying

Laser Tag Neon on Steam (now unavailable) Steam Community According to the reverse engineering analysis, the script then attempted to download a second-stage batch file from a hardcoded external server and execute it. During testing, however, that download returned a 404 error, meaning the final payload was never retrieved and its intended purpose remains unknown. Even so, the behavior itself — writing executable files outside the game directory and invoking PowerShell — is highly unusual for a Workshop map and strongly suggests malicious intent.

Who should act or wait

The researcher stopped short of identifying the final malware family because the second-stage payload was unavailable during analysis. However, they concluded that the Workshop item should be treated as malicious based on multiple indicators, including hidden execution logic, disguised Blueprint assets, and attempts to retrieve external code. The next step is to see whether the current signals harden into a durable change or fade as a short-lived experiment. That is why the useful reading move is not to stop at the headline, but to compare the promise, the workflow change, and the likely cost before deciding anything.

What is still unclear

Meccha Chameleon isn’t just another indie game. Since launching last month, the multiplayer hit has sold around 15 million copies, and industry analysts recently reported that it generated the second-highest PC game revenue of the month, behind only Fortnite . That massive audience makes it an attractive target for attackers looking to abuse community-created content.

Source notes

Digital Trends