Poker Malware in Two Tools Exposed High-Stakes Hole Cards

A hidden remote-access agent was planted on online poker players' Windows PCs through two compromised poker tools, according to a report published on September 29, 2026 by cybersecurity researcher @wolfsec0x0. Whoever controlled it could watch those screens live, hole cards included.

The researcher estimates between 10 and 30 players in Europe, North America and Oceania were hit, mostly high-stakes regulars. The earliest confirmed activity is from March 16, 2024, and on some PCs the agent stayed for more than a year, according to the researcher's full public report.

A PC that looks clean still needs checking. On September 27 the operator was seen uninstalling the agent remotely and deleting the scripts used to do it, but registry keys survive that clean-up, and some PCs still carry a Defender exclusion covering the whole Windows folder.

The researcher is not naming the two tools. One of them, table manager IntuitiveTables, has told users it was targeted, and separate allegations name the accounts said to be behind the attack. No poker site's own software is known to be involved.

What the Poker Malware Report Confirms

The agent belongs to MeshCentral, legitimate open-source software that companies use to manage computers remotely. On the affected PCs it was installed without the owner's knowledge, ran as a Windows service with full system privileges and connected to a server run by a third party.

⚠️ Online poker players: we've confirmed a covert remote-access agent planted on players' Windows PCs through compromised poker software.

Current estimate: ~30 users affected, in several countries across Europe, North America and Oceania.

Details and checks below 🧵

— WolfSec0x0 (@wolfsec0x0) September 29, 2026

According to the report, it contains only findings backed by preserved evidence, analysis of the software itself or a vendor's own confirmation. Affected players, vendors and products are all left unnamed.

What the Attacker Could Do

For as long as the agent was connected, whoever ran the server had the same access as someone sitting at the keyboard. The report lists four capabilities:

That reach went well beyond the poker table. Browser-saved passwords, saved payment cards and session cookies were all exposed, and the report warns that stolen session cookies can get past passwords and two-factor authentication until those sessions are revoked.

How It Reached Players' PCs

Both delivery routes ran through legitimate Windows utilities that poker players install themselves, each signed with its vendor's code-signing certificate. The report calls them Tool A and Tool B:

Why the signature did not help: Windows and antivirus software treat a validly signed program as trustworthy. A backdoored build signed with the vendor's own certificate looks exactly like a genuine update, which is why the report tells vendors to verify every update package before it runs.

Mesh Agent Timeline: March 2024 to the Report

The report's timeline runs from the first remote session to the vendor's confirmation. Every date below comes from evidence on affected PCs or from a vendor.

Why the clean-up matters: the operator removed the agent from some PCs before the report went public. Task Manager will show nothing on those machines, which is why the checks below look for the traces the agent leaves behind.

How to Check Your PC for Mesh Agent

The report publishes five read-only checks. None of them changes anything on your PC. Open PowerShell as administrator, because Windows only shows Defender exclusions to administrators, and run:

Get-Service -Name 'Mesh Agent' -ErrorAction SilentlyContinue
Get-ChildItem 'HKLM:\SOFTWARE\Open Source' -ErrorAction SilentlyContinue
Get-Item 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MeshCentralAgent' -ErrorAction SilentlyContinue
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 7045 } -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Mesh Agent' } | Select-Object TimeCreated, Message
(Get-MpPreference).ExclusionPath

Here is what each line looks for and what a result means:

The Defender Check Most Players Skip

The first four commands find the agent or its leftovers. The fifth catches something else: on affected PCs, Microsoft Defender had been told to ignore the entire C:\Windows folder.

On one PC that exclusion was removed two minutes after it was added. On others it is still in place, so Defender scans nothing in that folder. If C:\Windows is listed and you did not add it, treat the PC as compromised even if no agent turns up.

When MeshCentral Is on Your PC for a Reason

MeshCentral is used by employers and IT providers to manage computers, so a work laptop may carry it legitimately.

Rule of thumb: if nobody you trust set up MeshCentral on the machine, assume the agent is hostile and follow the steps below.

What to Do If You Find Mesh Agent on Your PC

The report's steps run in this order for a reason: preserve the evidence first, then lock down your accounts from a machine the attacker cannot see.

British online pro Patrick Leonard called the attack one of the biggest things to happen in online poker. He urged anyone who has played on desktop in recent years, especially higher-stakes cash players using third-party tools, to follow the thread and change their passwords.

This is one of the biggest things that has happened in online poker, how we react to it as a community and individuals is very important. If you’ve played online on a desktop in the last few years (and especially if higher stakes cash and used any 3rd party tools) please follow… https://t.co/z1PQ1y83vN

— Patrick Leonard 🫡 (@padspoker) September 29, 2026

Which Poker Tools Were Compromised?

The report withholds the names of both tools and their vendors, and the researcher's thread says the products are not being named publicly. The only name confirmed so far has come from a vendor itself.

IntuitiveTables Says It Was Targeted

Table manager IntuitiveTables issued a statement to its users, read out by Charlie Carrel in a YouTube video on September 30. The key points:

The statement as read out did not say which versions were affected or when they were served. Whether IntuitiveTables is the report's Tool A or Tool B is not public.

The Second Tool Is Still Unconfirmed

The other vendor has not confirmed that its build was tampered with, and no other tool has been named with evidence behind it. Until it is, anyone who runs third-party poker utilities on a high-stakes machine should run the checks above.

Who Is Accused of Being Behind It?

The researcher's report names no one and does not link the agent to any poker account. The accusations come from elsewhere.

Tournament regular Alexey “Avr0ra” Borovkov alleged on his Telegram channel that the operator played on GGPoker as Paul Gregg and on the Winning Poker Network under the names OxOO, JackKlompus and Ez[Pz]. Carrel repeated the Paul Gregg name in his video.

The researcher has also stressed that the poker sites' own clients are not the problem. In a follow-up post on X, wolfsec0x0 said no poker client is known to be malicious or infected, and that GGPoker, WPN, CoinPoker and WPT Global are not involved.

What the WPN Account Data Shows

On September 30, Run It Once coach Frankie Carson, who plays mid and high-stakes online cash games, posted results-tracking data for the two WPN accounts named in the allegations. The figures come from a third-party tracking site, not from WPN.

Carson alleges the operator played as JackKlompus until the summer of 2025, stepped away as players began to work him out, and returned in October as OxOO. He also claims OxOO lost on purpose at low and mid stakes to drag its overall win rate down.

Paul Gregg started in early 2024 on WPN as JackKlompus making $400k winning at +24bb/100 vs the best in the world.

He started feeling the pressure of people figuring him out, so in the summer of last year he stopped playing before resuming in October under the new screenname OxO… pic.twitter.com/9vguHebGAA

— Frankie Carson (@FrankieCPoker) September 30, 2026

The OxOO data shows small losses at most stakes from NL10 to NL1000. Its biggest win came at NL10000: $195.3k over 5.5k hands at 35.5bb/100, or 35.5 big blinds won per 100 hands.

What the data does and does not show: these are winnings recorded by a tracking site, not results confirmed by WPN, and they show that the accounts won rather than how. No WPN statement on either account has been published.

How the Mesh Agent Case Compares to Past Superuser Scandals

Online poker has seen hole cards exposed before. The closest precedent is a Danish case from more than a decade ago.

Danish pro Peter Jepsen installed spyware on opponents' computers so he could see their screens, and their cards, when he played them online. In December 2020 the Danish appeal court's ruling gave him three years for hacking and fraud.

The court also confiscated DKK 22.4 million. Jepsen is one of only four players in our list of every poker pro sentenced to prison who were jailed for cheating at the game itself.

The 2023 GGPoker case looked like a hole-card breach at first but was something narrower. The MoneyTaker69 client exploit on GGPoker let one player deduce all-in equity, and GGPoker patched the client and banned the account.

Russ Hamilton was never charged over the UltimateBet superuser accounts, a pattern that runs through poker's long record of cheating scandals.

What Happens Next

This story is still developing. These are the things to watch:

We will update this article as the vendors, the sites and the researcher publish more. The next developments will appear in our online poker news coverage.

FAQs