Meccha Chameleon's Steam Workshop was hit by malware, and then its Discord server was hacked

Meccha Chameleon, the biggest indie hit on Steam this year with over 15 million copies sold, has had a rough few days. Players who downloaded certain community Workshop maps were exposed to malware through a hidden PowerShell exploit, and separately the game's official Discord server was hacked after one of the developers' own machines got infected in the process of fixing the first problem.

The details:

• On July 24, independent security researcher Feint published a report documenting how a Workshop map called Laser Tag Neon, despite having passed Steam's Workshop review, was quietly writing a Windows command file into players' Documents folders and then using a hidden PowerShell window to download a second malicious script from an external server. After the map was removed, new malicious maps were uploaded in its place.
• Developer lemorion_1224 released update 3.1.0 to patch out the underlying vulnerability affecting custom maps, and confirmed the fix is in place.
• The Discord hack came as a direct consequence of the malware response. While working to contain the Workshop exploit, a system engineer's PC got infected. The hacker used that foothold to bypass the engineer's two-factor authentication on Discord, alter the server's permissions, and ban every staff member, locking the entire team out of the server.
• "We have already contacted Discord Support and are currently awaiting their response," the developers wrote on Steam. "If the server cannot be recovered, we will set up a new one." As of July 27, the server has been restored and the hackers have been banned.