AI Agent Uncovers Multi-Year Poker Malware Scheme Stealing Millions
A sophisticated cyberattack compromised high-stakes online poker players by installing malware through trusted third-party software updates. The malicious program, named MeshAgent, allowed an attacker to view opponents' cards in real-time, leading to millions in stolen funds. The scheme was exposed when an AI agent detected the unauthorized software on a victim's machine. While some poker sites acted quickly to ban the cheater and refund losses, others ignored prior reports, allowing the fraud to continue for months.
Key points
- An AI agent identified the MeshAgent malware on a professional poker player's computer on September 25, 2026, revealing it had been installed in April.
- The malware was distributed via compromised updates for popular multi-table poker tools, Jurojin and IntuitiveTables, affecting over 1,000 users.
- The attacker used the malware to view opponents' cards during high-stakes games, achieving statistically impossible win rates.
- The scheme allegedly stole between $1.5 million and $4 million from players across multiple sites, including ACR and GGPoker.
- CoinPoker and ClubWPT Gold acted decisively by banning the cheater and refunding losses, while GGPoker and ACR delayed action despite prior warnings.
- GGPoker later banned third-party tools and added win-rate anomaly detection, while ACR denied any wrongdoing and refused refunds.
Background
Online poker has faced cheating scandals since the mid-2000s, including the 'superuser' incidents at Absolute Poker and Ultimate Bet. A notable 2013 incident involved malware on a stolen laptop, and a 2018 live cheating scandal involved Mike Postle. This latest breach is the first confirmed superuser incident in online poker since a minor 2023 case, highlighting a new level of sophistication in the attack.
Why it matters
This incident exposes critical vulnerabilities in the supply chain of third-party software used by high-stakes gamblers. It underscores the growing threat of targeted malware that can compromise real-time data in competitive environments. The delayed response from major poker platforms raises concerns about their security protocols and the potential for irreparable damage to the integrity of online gambling.
What to watch
Poker sites are implementing new security measures, including banning third-party tools and enhancing anomaly detection. Cybersecurity experts are developing open-source tools to detect similar malware. Law enforcement agencies, including the FBI, are being engaged to investigate the scheme, though the attacker remains at large.
Want the full story? Read the original reporting
Read on WIRED