Jurojin and IntuitiveTables poker tools shipped MeshAgent, Wired reports

What happened

Wired reports that a hacker allegedly compromised two third-party multi-table poker tools, Jurojin and IntuitiveTables. According to Wired, the hacker used them to install a remote-access program called MeshAgent on the computers of high-stakes online poker players. Wired says the program let the alleged cheater see victims’ screens, including their cards. This account comes from a single outlet, based on players and a security consultant who spoke to Wired under pseudonyms. The developers of the two tools have not commented in the source material, and the identity of the attacker is not confirmed.

According to Wired, the compromise was spotted on September 25, 2026. A professional player, given the pseudonym Alex, was reviewing play statistics with a Claude AI agent. The agent flagged MeshAgent running in the background with apparent screen-capture and remote-control capability. Alex says the program had been installed on April 24, and not by him. He also says the agent identified 11 time-stamped screen-capture events, all during sessions on ACR (Americas Cardroom). Wired reports that the same opponent, handle “OxOO”, was at his table for 10 of those 11 sessions. Alex claims he lost around $30,000.

The supply-chain mechanism, as described by security consultant WolfSec to Wired:

• Jurojin: the attacker gained access to the developer’s software update system. The remote-access agent then reached existing users through normal automatic updates.
• IntuitiveTables: the developer ran Jurojin on a test computer, which received the compromised update. Using that access, the attacker added malicious code to IntuitiveTables before the developer signed an updated build. That build was posted as a public download on the IntuitiveTables website.
• Targeting: WolfSec says the modified IntuitiveTables checked players’ files for usernames and compared them with a list on the attacker’s infrastructure. Only users on that list received additional malicious files. For everyone else, it behaved like the normal program.
• Detection: Wired reports that because delivery came through a standard update channel or official release, neither users nor their antivirus apps detected anything.

WolfSec estimates the malicious software reached over a thousand users. Wired reports that hundreds of players were allegedly targeted over multiple years. WolfSec also believes the same actor attempted more basic attacks as early as 2022. These figures are estimates and are not independently confirmed. Wired also reports that the attacker did not appear to drain cryptocurrency holdings on victims’ machines, according to WolfSec.

Poker site responses reported by Wired:

• ClubWPT Gold: Randy Lundy, head of customer operations, says the site banned the account involved in a June 2026 session and refunded the affected player.
• CoinPoker: Mario Mosböck, a poker ambassador for the site, says CoinPoker began investigating the player in 2025. He says it banned them and refunded over $100,000 in allegedly stolen funds.
• ACR: the operator’s response is not confirmed in the source material.

Am I affected?

• You may be affected if you installed or auto-updated Jurojin, or downloaded IntuitiveTables from its website, during the compromise window. The exact affected versions and dates are not confirmed.
• According to WolfSec, the malicious payload was only delivered to usernames on the attacker’s list, which appears to have been mostly regular high-stakes players across several sites (Wired). Other users would have received a tool that behaved normally.
• The indicator named in the reporting is a MeshAgent program running in the background that you did not install yourself (Wired).
• Whether clean, fixed builds of either tool are available is not confirmed.

What to do now

1. Check running processes and installed software for MeshAgent, and note its install date. In the case Wired describes, the install date showed when the program arrived (Wired).
2. If you find MeshAgent and did not install it, disconnect the machine and treat it as fully compromised. Wired reports that the program appeared able to control the entire machine (Wired). A wipe and reinstall is the conservative option.
3. Stop using Jurojin and IntuitiveTables until their developers publish a statement and verified clean builds. No such statement is confirmed in the sources.
4. From a clean device, change passwords for poker sites, email and any cryptocurrency or financial accounts that were accessible on the affected machine.
5. If you suspect you played against an opponent who could see your cards, contact the poker site’s security team. ClubWPT Gold and CoinPoker both say they investigated and refunded affected players (Wired).

Sources

• Wired: A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards