conv.

All stories
SecurityQuiet 13d · day 14

Hacker stole millions from online poker players using MeshAgent malware

A suspected cheater used screen-capture malware against hundreds of high-stakes players across multiple years; discovery came when an AI agent flagged the intrusion.

newest coverage 13d agosummary written 13d ago7 pieces10 likes & upvotes MastodonNewswiresRedditGoogle News

What to know

  • A hacker used MeshAgent malware to steal screen captures and hole card information from hundreds of professional online poker players across multiple years, enabling a cheater to win millions.
  • The scheme was discovered accidentally on September 25, 2026, when a professional player's Claude AI agent flagged suspicious background processes during a database maintenance routine.
  • The same opponent (handle OxOO) appeared in 10 of 11 screen-capture sessions and showed statistically impossible win rates, raising questions about how major poker sites failed to detect or prevent the attack.
  • The incident follows a pattern of historical superuser scandals on online poker platforms and renews concerns about whether major sites have adequately secured against such attacks.

“With millions of dollars allegedly stolen across the biggest sites on the internet, the poker world is searching for answers about how the scheme was allowed to continue so long.”

Wired · Wired ↗

Alex Professional online poker player, first victim to discover MeshAgentOxOO Online poker player handle (suspected cheater)Americas Cardroom (ACR) Major worldwide online poker operator

Hacker stole millions from online poker players using MeshAgent malware
wired.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 4 pieces in 3h at Oct 29, 6 AM; 7 pieces over 14 days (4 articles · 3 posts) Oct 29, 6 AM — 4 pieces · 3 articles · 1 post — Mastodon 2, Google News 1, Newswires 1Oct 29, 9 AM — 1 piece · 1 post — Reddit 1Oct 29, 12 PM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Oct 29, 3 PM — quietOct 29, 6 PM — quietOct 29, 9 PM — quietOct 30, 12 AM — quietOct 30, 3 AM — quietOct 30, 6 AM — quietOct 30, 9 AM — quietOct 30, 12 PM — quietOct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — quietNov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — quietNov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — quietNov 2, 5 PM — quietNov 2, 8 PM — quietNov 2, 11 PM — quietNov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — quietNov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quietToday, 5 AM — quietToday, 8 AM — quietToday, 11 AM — quietToday, 2 PM — quietToday, 5 PM — quietToday, 8 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 9:14 PM ET
  1. 1

    Wired publishes investigation into poker malware cheating scheme

    Wired releases comprehensive reporting on the malware attack, detailing how the hacker's discovery came about through AI monitoring and the breadth of the alleged scheme. The story raises questions about how major poker sites allowed the scheme to persist and whether online poker has been compromised.

    “After Alex's SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background.”
    — Wired · source
    1. 1 outlet Hacker may have stolen millions in a malware attack against online poker players

      first by Engadget, 13d ago

  2. background

    High-stakes poker community investigation confirms hundreds of victims across years — An investigation by Alex and other members of the high-stakes community confirmed that hundreds of professional players had been targeted by the same threat actor deploying MeshAgent malware over multiple years. Alex reported losing approximately $30,000; many peers suffered far larger losses, with millions of dollars allegedly stolen across major online poker sites.

  3. background

    Alex traces malware exposure to consistent opponent OxOO across 10 of 11 sessions — By reviewing hand histories, Alex found that the same opponent, playing under the handle OxOO, was present at his table during 10 of the 11 instances when MeshAgent was capturing his screen. Public tracking data showed this player had a win rate statistically impossible for any professional.

  4. background

    Claude AI agent detects MeshAgent malware during database reset — When Alex's SQL database crashed and required a reset, his Claude AI agent discovered MeshAgent running in the background. The agent identified 11 time-stamped screen-capture events that coincided with poker sessions on Americas Cardroom.

  5. background

    MeshAgent malware installed on Alex's computer — An unknown attacker installed the MeshAgent program on the professional poker player's machine without authorization. The malware was designed to capture screen data and control the infected computer remotely.