Jurojin confirms tampered updates; malware exposed players' hole cards
Attackers compromised the update systems of the poker tools Jurojin and IntuitiveTables to distribute the MeshAgent remote-access malware, which activated only against a hard-coded list of high-stakes players and could view and control the machine, potentially exposing hole cards in real time. Jurojin confirmed tampered updates were selectively delivered between June 2025 and January 2026; players and investigators estimate $1.5 million to $4 million stolen, and CoinPoker and ClubWPT Gold banned suspected accounts and refunded affected players. Users of these tools should check for compromise and reinstall only clean versions.
What happened
Attackers compromised the update systems of the poker tools Jurojin and IntuitiveTables to distribute MeshAgent remote-access malware, which let them view and control victims' computers and potentially expose hole cards in real time. The malware activated only when a username matched a hard-coded list of high-stakes players. Jurojin confirmed tampered updates were selectively delivered between June 2025 and January 2026.
Why it matters
One professional player identified 11 screen-capture events during poker sessions and estimated losing about $30,000. Players and investigators estimate the suspected cheater stole between $1.5 million and $4 million across major poker platforms. The case shows supply-chain risk: customers were infected through the official update channel they trusted.
What to do
Users of Jurojin and IntuitiveTables should check for compromise, looking for MeshAgent running in the background, and reinstall only clean versions. CoinPoker and ClubWPT Gold banned suspected accounts and refunded affected players, and GGPoker banned third-party poker tools.
For the technical team
- Affected
- Sistemas de atualização das ferramentas de pôquer Jurojin e IntuitiveTables · Poker tools Jurojin and IntuitiveTables; tampered updates selectively delivered to users between June 2025 and January 2026, according to Jurojin. Specific versions not stated in the sources.
- Exploitation
- Exploitation confirmed by Jurojin: tampered updates delivered between June 2025 and January 2026. One professional player identified 11 screen-capture events during poker sessions and estimated a loss of about $30,000.
- Fix
- Source does not mention a fix, patched versions, or specific mitigation.
- Vector
- Supply chain: the update systems of Jurojin and IntuitiveTables were compromised to distribute the MeshAgent remote-access malware. The code activated only when a username matched a hard-coded list of high-stakes targets, helping it remain undetected.
- More details
- One player's infection was discovered after a Claude AI agent noticed MeshAgent running in the background. Players and investigators estimate between $1.5 million and $4 million stolen across major poker platforms; the individual accused by the poker community has not been charged. CoinPoker and ClubWPT Gold banned suspected accounts and refunded affected players; GGPoker introduced screen protection, anomaly detection and a ban on third-party poker tools.
Indicators (IoCs)
- MeshAgent
Timeline
Incident opened.
Sources 1 source
- @DarkWebInformer @DarkWebInformer
