🚨 High-stakes poker players targeted with malware that exposed their cards
An attacker compromised the update systems of popular poker tools Jurojin and IntuitiveTables to distribute MeshAgent remote-access malware to selected users.
The malware allowed the attacker to view and control infected computers, potentially revealing players’ hole cards in real time. It activated only when usernames matched a hard-coded list of high-stakes targets, helping it remain undetected.
⠀
One professional player discovered the infection after a Claude AI agent noticed MeshAgent running in the background. He later identified 11 screen-capture events during poker sessions and estimated that he lost around $30,000.
Players and investigators estimate that the suspected cheater stole between $1.5 million and $4 million across major poker platforms. However, the individual accused by the poker community has not been charged with a crime.
⠀
Jurojin confirmed that tampered updates were selectively delivered between June 2025 and January 2026. CoinPoker and ClubWPT Gold banned suspected accounts and refunded affected players, while GGPoker introduced screen protection, anomaly detection and a ban on third-party poker tools.
