In a striking demonstration of advanced threat detection, an **AI agent** has played a pivotal role in uncovering a sophisticated malware operation that has allegedly siphoned millions from professional online poker players. The incident came to light when "Alex," a professional online poker player (who spoke to WIRED under a pseudonym), was reviewing play statistics with his **Claude AI agent**. Following a database crash, the **Claude** agent flagged suspicious activity: a program named **MeshAgent** operating in the background, capable of screen capture and full machine control. The AI agent meticulously identified 11 instances of screen capture, all correlating with Alex's sessions on **ACR** (Americas Cardroom), a major online poker operator. ### The 'OxOO' Anomaly Alex's subsequent investigation revealed a disturbing pattern: the same opponent, playing under the handle "OxOO," was present in 10 of those 11 sessions. This handle was already familiar within the high-stakes community, with several players harboring suspicions about its statistically improbable win rates. Public tracking sites confirmed these suspicions, showing win rates far exceeding those of the world's best players, pointing unequivocally to cheating. Further investigation by Alex and his peers uncovered the terrifying scope of the breach: Alex was one of hundreds of players allegedly targeted by the same threat actor over several years. While Alex claims to have lost around $30,000 – a relatively moderate sum for his playing level – many others were not so fortunate, with total alleged losses reaching millions of dollars across major online poker sites. ### A History of 'Superuser' Scams The online poker world has a checkered past with cheating. Early incidents involving "superuser" methods, where cheaters gained unauthorized access to opponents' cards, led to major scandals at sites like **Absolute Poker** and **Ultimate Bet** in the mid-2000s. These events prompted significant security enhancements across the industry. Other notable incidents include a 2013 malware infection on a Finnish player's laptop and the highly publicized **Mike Postle** scandal at **Stones Gambling Hall** (2018-2019), where a live player was accused of receiving real-time card data. However, the online poker world had largely avoided confirmed superuser incidents for years, until now. ### A Patient and Sophisticated Threat Actor **WolfSec**, a cybersecurity professional consulting with high-stakes poker players, was the first to publicly disclose details of the **MeshAgent** scam. He noted the unusual patience and sophistication of this threat actor compared to typical financially motivated attackers. "Traditionally, when you see these types of financially motivated threat actors, they will get access to a system and then as soon as they’re on it, they’ll do a scope of what they have access to and then they’ll hit everyone all at once and dump all the wallets," WolfSec explained (speaking under a pseudonym due to fear of reprisals). This attacker, however, performed advanced reconnaissance, seemingly biding their time and refining their methods since as early as 2022. Rather than immediately cashing out, the attacker focused on gaining strategic advantages. ### Supply Chain Compromise: IntuitiveTables and Jurojin The latest attack vector involved compromising popular third-party poker software: **IntuitiveTables** and **Jurojin**. These applications are widely used by professional players to manage multiple tables simultaneously. In the case of **Jurojin**, the attacker gained access to the developer's update system, pushing the malicious remote-access agent to existing users via seemingly legitimate, automatic software updates. The developer of **IntuitiveTables** inadvertently became a conduit for the malware. Their test machine, running **Jurojin**, received the compromised update. The attacker then used the installed agent to embed malicious code into the **IntuitiveTables** application *before* the developer digitally signed the security certificate for an updated build. This tainted version was then posted as an official download on the **IntuitiveTables** website, creating a backdoor for unsuspecting users. Crucially, because the malicious code was delivered through standard update channels or official releases, neither the users nor their antivirus software detected any anomalies. ### Targeted Exploitation The modified **IntuitiveTables** application functioned normally, with one critical difference: it checked users' filenames against a hard-coded list stored on the attacker's infrastructure. If a username matched, the malware downloaded additional malicious files; otherwise, it remained benign. This highly targeted approach ensured that only high-stakes players, identified on the attacker's list, had **MeshAgent** covertly installed on their machines, preparing them for exploitation. ### The 'JackKlompus' and 'Europe' Persona In early 2025, new players using handles like "JackKlompus" on **ACR** and "Europe" on **CoinPoker** began appearing in high-stakes games. These unfamiliar players refused to identify themselves in table chats – a breach of common etiquette among pros – and exhibited improbably high win rates. Professional player "Mike" (also speaking under a pseudonym) initially wondered if these mystery players had simply developed a new, highly effective strategy. However, as pros began sharing information, it became clear these were the same individual, executing a sophisticated, long-term cheating operation enabled by the **MeshAgent** compromise. The full extent of the financial damage and the implications for the integrity of online poker remain under investigation.