Hacker Backdoors Jurojin and IntuitiveTables Poker Tools to Deploy MeshAgent and Steal Millions From High-Stakes Players
A threat actor compromised the poker multi-tabling tools Jurojin and IntuitiveTables in a software supply chain attack. The attack deployed the MeshAgent remote-access agent on the machines of an estimated 1,000+ users, with hundreds of high-stakes players allegedly targeted. The agent captured victims' screens, exposing their hole cards to an opponent playing under handles such as OxOO. Sources estimate $1.5-4 million was stolen on GGPoker and ACR (Americas Cardroom) before the scheme became public on September 29, 2026 via researcher WolfSec. CoinPoker and ClubWPT Gold banned the account and refunded victims. GGPoker announced fixes and traced funds to a Coinbase account, while ACR denied wrongdoing and refused refunds.
Detalhes técnicos
- The attacker gained access to Jurojin's developer update system and pushed MeshAgent to existing users through normal automatic updates.
- The IntuitiveTables developer ran Jurojin on a test computer, which received the agent. The attacker then injected malicious code into an IntuitiveTables build before the developer signed it. The build was published as a public download.
- The trojanized IntuitiveTables compared the local username against a hard-coded list hosted on attacker infrastructure. Listed users received additional malicious files; others got a benign program.
- Because delivery went through legitimate update and release channels, neither users nor antivirus detected it.
- Victim Alex's Claude agent found MeshAgent, installed April 24, and 11 time-stamped screen-capture events. All 11 coincided with ACR sessions, and the same opponent was present in 10 of them.
- WolfSec believes the same actor tried a more basic technique as early as 2022. The actor did not drain crypto wallets, instead performing patient reconnaissance and cheating over multiple years.
Remediação
- Jurojin and IntuitiveTables (via Discord) released tools to check whether machines were affected by MeshAgent.
- AceGuardian (A5 Labs) published an open-source superuser detection tool.
- GGPoker banned third-party tools and added win-rate anomaly detection. ACR announced a feature to block remote-viewing tools from capturing card images.
- Users of the affected tools should check for unauthorized MeshAgent installations.
- Sites should act on statistical win-rate anomalies without waiting for a public disclosure.
Linha do tempo
-
Hacker Backdoors Jurojin and IntuitiveTables Poker Tools to Deploy MeshAgent and Steal Millions From High-Stakes Players
ler a análise desta fonte ocultar
A threat actor compromised the poker multi-tabling tools Jurojin and IntuitiveTables in a software supply chain attack. The attack deployed the MeshAgent remote-access agent on the machines of an estimated 1,000+ users, with hundreds of high-stakes players allegedly targeted. The agent captured victims' screens, exposing their hole cards to an opponent playing under handles such as OxOO. Sources estimate $1.5-4 million was stolen on GGPoker and ACR (Americas Cardroom) before the scheme became public on September 29, 2026 via researcher WolfSec. CoinPoker and ClubWPT Gold banned the account and refunded victims. GGPoker announced fixes and traced funds to a Coinbase account, while ACR denied wrongdoing and refused refunds.
Technical Details
- The attacker gained access to Jurojin's developer update system and pushed MeshAgent to existing users through normal automatic updates.
- The IntuitiveTables developer ran Jurojin on a test computer, which received the agent. The attacker then injected malicious code into an IntuitiveTables build before the developer signed it. The build was published as a public download.
- The trojanized IntuitiveTables compared the local username against a hard-coded list hosted on attacker infrastructure. Listed users received additional malicious files; others got a benign program.
- Because delivery went through legitimate update and release channels, neither users nor antivirus detected it.
- Victim Alex's Claude agent found MeshAgent, installed April 24, and 11 time-stamped screen-capture events. All 11 coincided with ACR sessions, and the same opponent was present in 10 of them.
- WolfSec believes the same actor tried a more basic technique as early as 2022. The actor did not drain crypto wallets, instead performing patient reconnaissance and cheating over multiple years.
Remediation
- Jurojin and IntuitiveTables (via Discord) released tools to check whether machines were affected by MeshAgent.
- AceGuardian (A5 Labs) published an open-source superuser detection tool.
- GGPoker banned third-party tools and added win-rate anomaly detection. ACR announced a feature to block remote-viewing tools from capturing card images.
- Users of the affected tools should check for unauthorized MeshAgent installations.
- Sites should act on statistical win-rate anomalies without waiting for a public disclosure.