Malware exposed high-stakes online poker players' cards in multi-year campaign

Hundreds of players were allegedly targeted via screen-capture malware MeshAgent spread through third-party multi-tabling tools, with millions of dollars reportedly stolen.

WIRED reports that a threat actor installed screen-capture malware named MeshAgent on the computers of high-stakes online poker players to view their cards, allegedly defrauding victims of millions of dollars across multiple years. The campaign surfaced on September 25, 2026 when a player's Claude AI agent flagged the suspicious program during a statistics review; analysis showed screen capture during sessions on Americas Cardroom, with the same opponent present in 10 of 11 captured sessions. Security consultant WolfSec says the actor distributed the malware through the third-party multi-tabling tools IntuitiveTables and Jurojin, having run a more basic attack attempt as early as 2022. The player who discovered the malware estimates he lost around $30,000.

Unconfirmed: The cheating and theft figures are allegations by victims and the consulting researcher; the threat actor has not been identified or charged.