A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards

A hacker compromised two popular multi-table poker tools to plant surveillance malware on the machines of high-stakes online poker players, capturing their screens during sessions and exposing their hole cards. The scheme, which allegedly netted millions of dollars across major poker sites over a period of multiple years, is the first confirmed superuser incident in online poker in years, according to Wired.

The first break came on September 25, 2026, when professional player Alex, who spoke under a pseudonym to avoid reprisals, was reviewing play statistics with his Claude AI agent after his SQL database crashed. The agent flagged MeshAgent, a program installed April 24 that Alex had not installed and that could capture his screen and control his machine. The agent identified 11 time-stamped screen-capture events, all during sessions on Americas Cardroom (ACR), and Alex found the same opponent, playing as OxOO, at his table for 10 of them.

Alex checked OxOO's win rate on a public tracking site and found it astronomically higher than the best players in the world, a statistical impossibility for the sample played, in his view. Alex said he was defrauded of roughly $30,000, a moderate sum at his level, while hundreds of other players were allegedly targeted over multiple years. WolfSec, a cybersecurity professional who advises high-stakes players and first reported the MeshAgent scam on X on September 29, said the actor favored reconnaissance over the usual smash-and-grab theft of wallets.

WolfSec said the attacker compromised IntuitiveTables and Jurojin, multi-table programs that let professionals play dozens of hands at once, pushing malware to an estimated 1,000-plus users. In Jurojin's case, the attacker accessed the developer's software-update system and delivered a remote-access agent through automatic updates. The IntuitiveTables developer ran Jurojin on a test machine that received the agent, letting the attacker add malicious code to IntuitiveTables before the developer signed its security certificate for a public build.

The tampered IntuitiveTables worked normally unless a player's username matched a hard-coded list on the attacker's infrastructure; matches triggered additional malicious downloads. WolfSec believes the same actor targeted players' machines as early as 2022 with a more basic technique, and that no action was taken after players wiped that malware because no known funds were stolen. The source article also noted that in early 2025 a couple of new players began frequenting high-stakes games, one on ACR using the handle JackKlompus.

More cybersecurity news from TechManNews.