::Cybersecurity professional, poker enthusiast:: Reported on 2026 Poker Software Supply Chain Attack
- Tweets 100
- Following 120
- Followers 1,118
- Likes 49
Pinned Tweet
⚠️ Online poker players: we've confirmed a covert remote-access agent planted on players' Windows PCs through compromised poker software.
Current estimate: ~30 users affected, in several countries across Europe, North America and Oceania.
Details and checks below 🧵
45
99
497
852,764
Since I"m seeing a lot of questions about this:
When the number ~30 was given with the initial report/tweet, this was the CONFIRMED number of players that had found MeshAgent running on their boxes.
Since then, a much larger number of players have been found via ... (Continued)
5
3
24
13,704
... Poker sites (WPN, COIN, WPT, etc) have sent emails if they have any record of you having MeshAgent on your computer while playing.
Without getting access to every single players triage results, I cannot say for certain where/how they were infected...(cont)
4
8
3,009
WolfSec0x0 retweeted
People keep asking what's new here.
Old ratting cases: victim gets tricked into opening a file, or someone gets physical access to their laptop.
This one: the hacker compromised Jurojin and Intuitive Tables, so official versions of both carried his code. It read your screen name from your hand histories and only infected you if you were on his list.
A couple of quick updates as coffee is being ingested:
As many of you have gleaned, Jurojin and IntuitiveTables were the two known compromised softwares.
We are still learning more about the attacks.
Even though most of us that have used.... (continued in reply)
2
2
32
9,791
A couple of quick updates as coffee is being ingested:
As many of you have gleaned, Jurojin and IntuitiveTables were the two known compromised softwares.
We are still learning more about the attacks.
Even though most of us that have used.... (continued in reply)
4
12
79
32,226
... On their c2 server. Basically, if you weren't on that list, the application functioned normally and you never got infected with anything. If you WERE on the list, a number of additional files were downloaded and executed, leading to compromise.
1
13
3,864
WolfSec0x0 retweeted
Hi everyone! We're looking into the @wolfsec0x0 report in depth, working with him and sharing everything we find. Based on his version, we've made a quick tool (signed) that checks whether your PC is affected. Download it here: jurojinpoker.com/meshcheck/d…
4
5
33
8,474
Would love to see a proper response from the affected sites and full cooperation with law enforcement!
2
4
2,716
I shouldn't need to specify this, but I will:
No poker client is known to be malicious/infected. You might hate GG/WPN/Coin/WPTg but they're not involved in this situation.
1/2
8
32
12,934
WolfSec0x0 retweeted
Looks very, very bad. This will change online poker forever.
Important to note that this attack specifically targeted regulars playing the highest stakes, not recreational or low-mid stakes players.
⚠️ Online poker players: we've confirmed a covert remote-access agent planted on players' Windows PCs through compromised poker software.
Current estimate: ~30 users affected, in several countries across Europe, North America and Oceania.
Details and checks below 🧵
27
14
259
220,041
One of the biggest things to know regarding the recent poker hacking news:
This was an extremely targeted attack - Only specific players (High stakes mainly) were targeted and subsequently infected.
6
2
25
9,678
⚠️ Online poker players: we've confirmed a covert remote-access agent planted on players' Windows PCs through compromised poker software.
Current estimate: ~30 users affected, in several countries across Europe, North America and Oceania.
Details and checks below 🧵
45
99
497
852,764
Everything here is confirmed, apart from the 10–30 estimate. Samples were analysed statically only: nothing was executed, and no connection was made to attacker infrastructure.
Full public report: [link]
Credit: @wolfsec0x0 (X) / KCC Discord
1
11
16,541
(Woops - forgot to put link to FULL REPORT: pastebin.com/XanaDYWZ)
1
2
21
16,088