Hacks Hiding in Meccha Chameleon

Summary

The video argues that Mecha Chameleon, a popular “hide in plain sight” game that supports user-generated custom maps via Steam Workshop, has been hit by a serious vulnerability that enables remote code execution (RCE)—described as effectively “two-click” for the victim.

How the hack works (core report)

• Steam Workshop uploads: The creator explains that Steam Workshop items are essentially uploaded file folders, and Steam’s workflow ends up accepting arbitrary file formats, not just safe game assets.
• Victim downloads the map: When a player joins a lobby and selects/loads a custom map, players who don’t have the map are prompted to download/subscribe.
• Unreal Engine triggers “begin play”: When the downloaded map is loaded, Unreal Engine’s map lifecycle includes an event such as “begin play”, which can be abused to launch a URL.
• File URI leads to Windows execution: The dangerous part is that, when given a file URI, the URL-opening behavior invokes Windows functionality equivalent to ShellExecuteW, allowing it to open arbitrary files that were previously downloaded/placed on the system.
• Comparison to a Notepad exploit: The presenter connects this to a recently reported Notepad markdown-related file URI exploit, claiming the underlying mechanism is very similar: a link/URI causes Windows to open unintended local content.

Why it matters (analysis / broader warning)

• Systemic risk: The presenter frames this as a systemic risk—many indie games allow custom content, and similar patterns could exist elsewhere.
• User safety PSA: The takeaway is that users should be cautious about what they download and run, with parallels to developer security practices like installing packages (e.g., NPM) that execute post-install scripts.
• Malware/worm propagation pathway: The conclusion warns that “agents” / downloadable code-like content and user content pipelines can become a new pathway for malware or worm-style propagation, since popularity doesn’t guarantee safety.

Acknowledgment

• The video credits the underlying research write-up to a blogger referenced as Kale Kugler, thanking them for the security research.

Presenters / contributors

• Brian — main presenter/speaker
• Kale Kugler — author of the referenced blog post
• Sentry — mentioned as the sponsor; no individual named