A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards
A hacker targeted high-stakes online poker players with malware that allowed them to see opponents' cards, potentially stealing millions of dollars across multiple years.
Professional online poker player Alex discovered illicit software on his computer in September 2026 that had been covertly capturing his screen during high-stakes games. The malware, called MeshAgent, had been installed on April 24 without his knowledge and allowed a hacker to see his cards and control his machine.
Alex's discovery came when his Claude AI agent detected suspicious activity after his SQL database crashed. The AI identified 11 time-stamped events when the program had been capturing his screen during screen sharing instances, all of which occurred while he was playing on ACR, also known as Americas Cardroom.
Upon reviewing his hand histories, Alex found that the same opponent, playing under the handle OxOO, was at his table for 10 of those 11 sessions. This player's win rate statistics were astronomically higher than the best players in the world, which Alex considered a statistical impossibility.
Targeted Players
An investigation by Alex and other high-stakes players revealed that hundreds of players had allegedly been targeted with similar malware over multiple years. Alex claims he was "only" ripped off for around $30,000, while many of his peers lost significantly more.
It was glaringly obvious that this player was cheating.
Sophisticated Attack
Unlike typical financially motivated attacks, this hacker didn't immediately steal cryptocurrency holdings or other accessible assets. Instead, they performed advanced reconnaissance, compromising third-party poker software programs called IntuitiveTables and Jurojin to deliver the malicious code.
The attacker gained access to Jurojin's developer system for software updates, delivering the remote-access agent through normal updates. For Intuitive Tables, the attacker compromised the developer's test computer and added malicious code before the official release was signed.
The modified Intuitive Tables checked players' files for usernames against a hard-coded list. If a player was on the list, the malware downloaded additional malicious files; otherwise, it functioned normally. This selective targeting helped the hacker avoid detection.
Suspicious Players
In early 2025, new players using handles "JackKlompus" on ACR and "Europe" on CoinPoker began winning with improbable frequency. These players refused to identify themselves in table chats, which is unusual for new high-stakes players.
Professional poker player Mike, who played at tables with these accounts, initially wondered if the success was explainable. "You could kind of excuse it at first," Mike says. "Maybe this guy is really, really good or something." As the winning hands accumulated, Mike and other pros became more suspicious and stopped playing at those tables as a precaution.
The hacker demonstrated unusual skill and discipline compared to other known cheaters, using standard bet sizes and normal hand ranges. Only the account's unsustainable win rate over time drew scrutiny from professionals.
Related
