A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards

In a fitting motion of the times, the hacker’s cautiously laid plans were foiled by an AI agent.

It was September 25, 2026, and Alex, a nonrecreational online poker player, was utilizing his Claude AI cause to reappraisal immoderate play statistics. (Alex lone agreed to talk with WIRED nether a pseudonym to debar immoderate hazard of reprisals from menace actors.) After Alex’s SQL database crashed and needed to beryllium reset, the Claude cause noticed thing suspicious: A programme called MeshAgent was operating successful the background, wherever it seemed to beryllium susceptible of capturing Alex’s surface and adjacent controlling his full machine.

Thanks to the Claude agent’s report, Alex could spot the programme had been installed connected April 24, and not by Alex himself. Alex says the cause identified 11 time-stamped events erstwhile the programme had been capturing his surface based connected graphic errors it caused during surface sharing instances. During each 11, Alex had been playing a league connected ACR, besides called Americas Cardroom, a large worldwide online poker operator.

He checked his manus histories and rapidly recovered the astir troubling info yet: The aforesaid opponent, playing nether the grip OxOO, was astatine his array for 10 of those 11 sessions.

The grip was familiar. Alex and respective friends successful the high-stakes assemblage had shared suspicions astir this player’s behaviour successful the past. Alex checked the player’s triumph complaint stats via a nationalist tracking site; they were astronomically higher than the champion players successful the world, a statistical impossibility fixed the illustration of hands played. In Alex’s view, it was glaringly evident that this subordinate was cheating.

An probe by Alex and different members of the high-stakes assemblage successful consequent days confirmed his fears—and past some. Alex was 1 of hundreds of players allegedly targeted with this benignant of malware by the aforesaid reported menace histrion crossed a play of aggregate years. Alex, who was the archetypal to observe MeshAgent connected his computer, claims helium was “only” ripped disconnected for astir $30,000, a comparatively mean sum for the level helium plays at; galore of his peers weren’t truthful lucky.

With millions of dollars allegedly stolen crossed the biggest sites connected the internet, the poker satellite is searching for answers astir however the strategy was allowed to proceed truthful long, whether large sites took the hazard earnestly aft it was reported, and whether online poker itself has been irreversibly compromised.

Poker has never been abbreviated connected cheating controversies; online poker particularly so. The “superuser” method, successful which a cheater gains unauthorized entree to their opponents’ cards and tin truthful enactment with cleanable accusation against them, was 1 of the archetypal to amusement up online.

Two large sites successful online poker’s aboriginal days, Absolute Poker and Ultimate Bet, served arsenic cautionary tales successful the mid-2000s. In abstracted instances, superuser cheaters were capable to summation insider entree to the websites and bilk players for millions of dollars. (Much of the loot was refunded to players pursuing an investigation.) Those high-profile incidents led to tightened information measures from galore apical poker sites.

Another insignificant superuser incidental took spot successful 2013, erstwhile a Finnish high-stakes subordinate said his laptop had been stolen from his edifice country during a European Poker Tour tourney successful Barcelona. When the laptop was recovered, it had been infected with malware that allowed a hacker to presumption his surface remotely. And possibly the most famous superuser ungraded of each took spot connected the unrecorded felt: In a communicative that made it each the mode to SportsCenter, a subordinate named Mike Postle was accused of stealing implicit $250,000 from livestreamed games astatine Stones Gambling Hall successful 2018 and 2019 with the assistance of what observers believed to beryllium an alleged accomplice with entree to unrecorded paper information who fed accusation to Postle’s phone. (Postle denied the accusations, alleging it was “fake news.”)

Outside one comparatively small (and rapidly remedied) incidental successful 2023, though, the online poker satellite had gone years without a confirmed superuser incident—until now. And immoderate of what’s known astir this latest effort signals a savvier menace histrion than successful erstwhile scandals, positive a grade of patience not typically seen successful attacks similar these.

“Traditionally, erstwhile you spot these types of financially motivated menace actors, they volition get entree to a strategy and past arsenic soon arsenic they’re connected it, they’ll bash a scope of what they person entree to and past they’ll deed everyone each astatine erstwhile and dump each the wallets,” says WolfSec, a cybersecurity nonrecreational who consults with galore high-stakes poker players connected information measures. He was archetypal to interruption the quality of the MeshAgent scam connected September 29, on his X account. (WolfSec agreed to talk to WIRED nether the information his existent sanction not beryllium utilized retired of fears of reprisals from hackers; WIRED independently confirmed his credentials arsenic a cybersecurity expert.)

But this hacker didn’t bash immoderate of that, contempt galore of these players having ample cryptocurrency holdings and different investments accessible connected their machines. The attacker seemed alternatively to beryllium performing precocious reconnaissance. In fact, WolfSec believes the aforesaid menace histrion was attempting to onslaught players’ machines arsenic aboriginal arsenic 2022 utilizing a much basal technique; due to the fact that nary known funds were stolen astatine the time, nary different enactment was taken erstwhile the players wiped the malware from their computers.

It appears, though, that the hacker was simply biding his clip and improving his methods successful mentation for an eventual strike.

Instead of targeting idiosyncratic players directly, this much caller onslaught progressive third-party bundle programs called IntuitiveTables and Jurojin. These programs let professionals to play dozens of online poker hands astatine once. Using these fashionable “multi-table” tools, players tin power betwixt unrecorded games with a keystroke, spot bets oregon marque plays with blistery keys, and different actions that marque it easier to play astatine respective virtual tables astatine the aforesaid time. The hacker compromised some applications, WolfSec says, pushing malicious bundle to implicit a 1000 estimated users.

In the lawsuit of Jurojin, the attacker gained entree to the developer’s ain strategy for bundle updates and was capable to present the remote-access cause to existing users done normal, automatic updates.

The developer of Intuitive Tables was moving Jurojin connected their trial computer, and that instrumentality got the remote-access cause arsenic portion of Jurojin’s compromised bundle update. Using the agent, the attacker added malicious codification to the Intuitive Tables exertion earlier the developer signed the information certificate for an updated physique of the app. That mentation carrying the malicious codification was posted to the Intuitive Tables website arsenic a nationalist download, and everyone who installed that mentation of the app unknowingly besides installed a backdoor connected their computer.

In some instances, the malicious codification was delivered done a modular update transmission oregon an authoritative release, truthful neither the users nor their antivirus apps detected thing amiss.

The modified mentation of Intuitive Tables behaved precisely similar the cleanable version, with 1 exception: It besides checked players’ files for their usernames.

“If you were connected a hard-coded database that was stored connected the attacker’s infrastructure, which [the malware] reached retired to and downloaded and compared your username to, past it acted arsenic a malicious programme and downloaded further malicious files,” WolfSec says. “If you weren’t connected that list, past it became the mean programme and didn’t bash thing malicious astatine all.”

The database appears to person been populated chiefly with regular high-stakes players crossed respective sites. All of the players connected the database look to person had the MeshAgent programme installed covertly connected their machines. The hacker was acceptable to pounce.

In aboriginal 2025, a mates of caller players began frequenting high-stakes games—one connected ACR (using the grip “JackKlompus”) and different large planetary tract called CoinPoker (handle: “Europe”). Strangely, contempt not being acquainted to different regulars successful these games, the players refused to place themselves successful array chats, a communal petition that’s typically granted by caller players successful high-stakes poker. The caller opponents were besides winning with improbable frequency. (Later, erstwhile the pros started sharing accusation astir their games, it was pieced unneurotic that these players were the aforesaid person.)

Mike, a nonrecreational poker subordinate who spoke to WIRED utilizing a pseudonym owed to fearfulness of reprisals from hackers, played connected some sites astatine the clip and was astatine tables with the subordinate utilizing these handles. Mike says astatine archetypal helium wondered if the enigma player’s occurrence was someway explainable. Maybe they were doing thing caller that Mike and his chap pros conscionable hadn’t figured out.

“You could benignant of excuse it” astatine first, Mike says. “Maybe this feline is really, truly bully oregon something.”

As the fig of winning hands grew, though, Mike and respective high-stakes friends became much suspicious. They initially suspected that the subordinate was utilizing real-time assistance via game-theory-based engines that outperform the champion quality players. Real-time assistance is banned crossed large sites, but is hard to constabulary perfectly and is thing pros are regularly watching retired for. Mike mostly stopped playing astatine tables with the enigma player, arsenic a precaution.

Like WolfSec, Mike reflects connected a comparative level of accomplishment and subject employed by this subordinate during those 2025 sessions, particularly compared to different known cheaters successful poker history. The relationship mostly utilized modular stake sizes and played mean manus ranges. Its session-by-session play ne'er raised excessively galore eyebrows; lone the account’s triumph complaint implicit clip drew scrutiny.

But successful June 2026, Mike played a two-hour heads-up (one-on-one) league connected a antithetic site, ClubWPT Gold, which he’d aboriginal determine—following reviews with the website’s information team—came against the aforesaid subordinate from the 2025 sessions. The subordinate utilized a antithetic grip to evade detection, truthful Mike didn’t spot a crushed to beryllium other cautious. The hostile simply steamrolled Mike, making each close determination adjacent successful seemingly intolerable spots—almost similar helium could spot Mike’s cards. “It was precise blatant,” Mike says.

Immediately aft the session, Mike messaged respective friends successful the high-stakes satellite to accidental helium thought he’d been cheated.

Turns retired helium was right. When connection of the hack broke publically connected WolfSec’s X account, ClubWPT Gold investigated. The tract banned the relationship Mike had played against and refunded him for his losses, says Randy Lundy, caput of lawsuit operations for ClubWPT Gold.

This alleged cheater’s beingness successful online circles was an unfastened concealed crossed the assemblage by this point. In fact, Mario Mosböck, a poker ambassador for CoinPoker who was authorized to talk astir the company’s effect to the hack, says the tract began investigating this subordinate arsenic aboriginal arsenic 2025, banning them and refunding implicit $100,000 successful allegedly stolen funds to affected players. (Mosböck says the instrumentality of funds was delayed respective months due to the fact that the alleged cheater appealed the confiscation to regulators.) The player’s elemental triumph complaint and play benignant statistic appeared to beryllium grounds of malfeasance, adjacent if the tract couldn’t definitively find however the cheating was happening.

How, then, was the aforesaid alleged cheater allowed to support ripping disconnected players similar Alex and Mike connected aggregate different supposedly reputable sites much than a twelvemonth later?

“They confirmed multiple times that they looked astatine my report, but for immoderate crushed they didn't enactment connected it,” says Patrick Howard, a nonrecreational poker subordinate and laminitis of the coaching institution Mobius Poker.

The “they” he’s referring to is GGPoker, arguably the astir well-known tract successful the satellite for non-US players. Howard says helium submitted a study to the tract successful aboriginal September 2026, weeks earlier the MeshAgent hack became public, highlighting the alleged cheater’s antithetic play and urging the tract to investigate.

“I recovered aggregate three- to four-standard-deviation outliers,” Howard says, and that was crossed a constricted manus past illustration sent to him by friends and clients. He sent his findings to the GGPoker squad but received nary response. He got a reply lone aft WolfSec’s nationalist uncover of the hack connected X, with the tract telling him determination “wasn’t conclusive evidence” to enactment astatine the clip of his complaint.

Various online poker sites handled the incidental differently. Players person mostly praised CoinPoker for proactively banning the subordinate based connected triumph complaint and play tendencies alone, which are accepted arsenic definitive indicators of cheating astatine stakes this precocious and with samples this large; portion ClubWPT Gold lone seems to person been impacted aboriginal successful the scheme, that tract besides appears to person acted decisively upon discovering it.

But the hacker remained progressive connected GGPoker and ACR until precocious September, allegedly stealing betwixt $1.5 cardinal and $4 million, based connected the estimates of the sources WIRED spoke to for this story.

“Players are frustrated, due to the fact that they had been reporting this for a year,” says John Andress, caput of crippled integrity for A5 Labs, a cybersecurity level that provides anti-cheating services to ClubWPT Gold and different brands. “A fewer of the platforms conscionable wholly ignored them.”

This was contempt signs that galore consciousness were each excessively obvious.

CoinPoker says the player’s alleged existent individuality was known aboriginal successful this process, aft the institution conducted a webcam information interrogation with them successful February 2025. The sanction the subordinate gave matched the grip the subordinate aboriginal utilized connected GGPoker, which requires players to usage their existent sanction arsenic their grip alternatively of a pseudonym for definite high-stakes games. (WIRED is not naming the subordinate due to the fact that they person not been charged with immoderate crime. The subordinate did not respond to aggregate requests for remark connected this story). The CoinPoker spokesperson says their squad reached retired to ACR with their findings arsenic good and received nary response. (Requests for remark from WIRED to ACR and GGPoker received nary reply.)

To its credit, GGPoker acknowledged the incidental and announced respective fixes successful an October 15 blog post, including banning third-party tools and adding win-rate anomaly detection. The tract besides says it traced the accused attacker’s funds to a Coinbase relationship and has asked the crypto institution to restrict the relationship and sphere its records; it says it besides provided the wallet addresses to manufacture watchdogs and instrumentality enforcement.

But ACR is going the other direction: On October 18, it emailed players claiming its information squad recovered nary compromised crippled outcomes oregon wrongdoing and volition not contented immoderate refunds—despite, successful the aforesaid email, announcing a caller diagnostic to halt remote-viewing tools from capturing the images of the cards successful players’ hands.

Other entities person taken factual action: Both Jurojin and IntuitiveTables (via its Discord channel) released tools to assistance users observe whether the MeshAgent hack had affected their machines. AceGuardian, a probe radical that’s portion of A5 Labs, enactment retired an open-source “superuser detection” tool designed for usage connected immoderate poker site. WolfSec says helium submitted a ailment to the the Internet Crime Complaint Center, the cybercrime limb of the FBI, and has been moving with players connected improving instrumentality security. The FBI, erstwhile reached for remark by WIRED, would not corroborate receipt nor immoderate details of this complaint.

But these efforts volition beryllium truthful palmy lone if the sites dainty these incidents with much scrutiny and don’t conscionable outpouring into enactment successful the aftermath of large attacks.

“Ultimately, the sites person to prohibition the players,” Howard says. “I deliberation they dropped the shot here.”