Update, 27 July. The Discord is back: the studio reports the official server has been restored and every hacker banned — rejoin via the official link in the Steam announcement. Update 3.3.0 shipped the same day, adding a new “Plump” character body type. The incident closed in two days.
In a single day Meccha Chameleon went from “our Discord has been hijacked” to a full incident breakdown and a patch. On 25 July the developer announced that the official community server had been taken over and the team could do nothing about it — access was gone entirely. Rumours then spread that a virus was embedded in the game itself, and the studio had to answer that in a separate post.
What actually happened
The timeline the developer reconstructed and published:
- It started with a mod map. The team was investigating a malicious user-made map and patching the flaw that let a mod execute unrelated files.
- An engineer’s PC got infected. During that investigation a system engineer’s machine picked up malware.
- That machine cost them the Discord. A single admin account was compromised — enough to lose control of the server. The team contacted Discord Support and warned that if the server cannot be recovered, a new one will be created.
- The game is untouched. In a separate FAQ the studio answers the community’s main question directly: there is no virus or malware in the game client.
The incident is limited to one compromised Discord admin account. The build itself is clean — confirmed on the Steam Support side as well.
Patch 3.2.0 closed the mod hole
Update 3.2.0 shipped on 26 July. Content-wise it is modest — 12 new emotes and the eyedropper button removed from the colour palette. The note at the end matters more: the safety issue was already resolved in the previous version, and executing unrelated files through mods is no longer possible. The original attack vector was closed in the client, not buried in the comments.
Current statuses for our builds are on the Meccha Chameleon page.
What this means for players running software
The awkward part is that this hits the usual channels of trust.
- Download nothing from the hijacked Discord. While the server is in someone else’s hands, any “urgent patch”, “launcher fix” or link posted there is potential malware. It is the classic play: take over a channel with a reputation, then hand out a file that looks official.
- User-made maps carry the same risk. The flaw that started all this lived in mods. If you play with third-party content, install it from trusted sources only.
- Update to 3.2.0 before you play. And check that your build is declared compatible with it: the game shipped 3.1.0 and 3.2.0 within two days, and two patches back to back almost always means rebuilt offsets.
- Separate “virus in the game” from “hijacked channel”. The panic came from conflating the two. The client is clean; what was compromised was the communication layer — a different level of threat entirely.
Bottom line
For a small studio this is a textbook case: one infected work machine wiped out control of the entire player-facing channel. For players the takeaway is simpler — for the duration of the incident, Steam announcements are the source of truth, not Discord. The game client is safe, the mod hole is patched, and the community server may well have to be rebuilt from scratch.
Dominate MECCHA CHAMELEON with our software
Verified cheats and software — updates within 12–48 hours after major patches, with guarantees and 24/7 support.