Table of Contents
A sophisticated malware attack targeting popular third-party poker applications has allowed a hacker to view the private cards of high-stakes online poker players, resulting in an estimated $1.5 million to $4 million in stolen funds. The breach, uncovered in late September 2026, allegedly affected hundreds of players across multiple major online poker platforms over a multi-year period.
Uncovering the Cyber Intrusion
The security flaw came to light on September 25, 2026, when a professional online poker player operating under the pseudonym Alex used a Claude artificial intelligence agent to review his statistics. After his SQL database crashed and required a reset, the AI agent detected a background program named MeshAgent, which was capable of capturing screen images and remotely controlling his system.
According to Alex, who spoke to WIRED on condition of anonymity to avoid reprisals, the program had been installed without his authorization on April 24. The AI identified 11 time-stamped instances of screen capturing while Alex was actively playing on Americas Cardroom (ACR). A review of hand histories revealed that an opponent using the screen handle OxOO was at Alex’s table during 10 of those 11 sessions. Public tracking data showed the opponent’s win rate was statistically impossible for human players. Alex estimated his personal losses from the breach at approximately $30,000.
Cybersecurity consultant WolfSec, who spoke to WIRED under a condition of anonymity and whose credentials were independently verified by the outlet, first publicized the MeshAgent breach on September 29 on the social media platform X. WolfSec subsequently filed a complaint regarding the incident with the FBI’s Internet Crime Complaint Center.
Software Supply Chain Compromised
The attacker executed the scheme by compromising third-party software applications used by professional players to manage multiple tables simultaneously, specifically Jurojin and IntuitiveTables. According to WolfSec, the hacker gained access to Jurojin’s software update system, delivering the remote-access malware directly to users through legitimate automatic updates.
The developer of IntuitiveTables, who ran Jurojin on a test computer, inadvertently received the compromised update. The attacker used that access to inject malicious code into IntuitiveTables before its security certificate was signed. Consequently, users who downloaded the official release installed a backdoor on their devices.
The modified software queried an external server holding a list of targeted usernames. If a user’s name matched the list, the program downloaded MeshAgent to enable remote screen monitoring; otherwise, it functioned normally. WolfSec noted that unlike typical financially motivated attackers, the threat actor demonstrated unusual patience, engaging in reconnaissance as early as 2022 rather than immediately draining cryptocurrency wallets or other financial assets.
Player Impacts and Historical Context
Another professional player, speaking to WIRED under the pseudonym Mike, recounted losing heavily during a two-hour session on ClubWPT Gold in June 2026 against an opponent who made flawless decisions. Following public reports of the hack, ClubWPT Gold investigated, confirmed the opponent was the same cheater using a different alias, banned the account, and refunded Mike’s losses, according to Randy Lundy, head of customer operations at ClubWPT Gold.
The incident represents one of the most severe superuser scandals in online poker history, recalling mid-2000s security breaches at Absolute Poker and Ultimate Bet, a 2013 malware theft targeting a player’s laptop in Barcelona, and the 2018–2019 live stream cheating allegations involving Mike Postle at Stones Gambling Hall.
Reactions Across Poker Platforms
Online poker operators have taken contrasting approaches to the breach. CoinPoker ambassador Mario Mosböck told WIRED that the platform identified the player as early as 2025 through a webcam security interview, banned the user, and refunded over $100,000 to impacted players after an appeal process concluded.
Conversely, poker analyst Howard told WIRED he submitted statistical evidence of extreme win-rate anomalies to GGPoker in early September 2026, but the platform initially took no action, citing a lack of conclusive evidence. Following public disclosure of the breach, GGPoker announced on October 15 that it had banned third-party tools, implemented win-rate anomaly detection, and requested Coinbase to restrict an associated account while forwarding wallet details to law enforcement.
On October 18, ACR emailed players stating its security team found no compromised game outcomes and would not issue refunds, although it simultaneously introduced a feature designed to prevent remote-viewing tools from capturing card graphics. Requests for comment sent by WIRED to ACR, GGPoker, and the accused player went unanswered, while the FBI declined to confirm receipt of the complaint.
In response to the incident, Jurojin and IntuitiveTables released detection tools for users, while AceGuardian, a research arm of cybersecurity platform A5 Labs led by John Andress, made an open-source superuser detection tool publicly available to help players identify compromised systems.
