Paul Gregg is alleged to have cheated on a large scale in several poker rooms. Using MeshAgent software, he is said to have made his opponents’ hole cards visible.
For weeks, there has been talk of a new scandal within the poker community. MTT regular Aleksey “Avr0ra” Borovkov has now published details on his Telegram channel.
According to the allegations, the potential cheater installed MeshAgent on his opponents’ computers and gained access to them. MeshAgent and MeshCentral are open‑source software that let a user perform remote maintenance. Among other things, this allows the screens of infected computers – and therefore the hole cards of opponents – to be viewed.
According to Aleksey Borovkov, the cheater played under the name Paul Gregg on GGPoker, and under the names OxOO, JackKlompus, and Ez[Pz] on WPN. Another screen name is said to have been Europe. The account is said to have been operated from Canada.
It is suspected that Paul Gregg did not act alone. How the malicious software got onto the high‑stakes players’ computers is currently being discussed. The trojan is said to have reached the computers through several routes.
In the poker community, there is speculation that a poker room client could have been responsible. However, there is no evidence for this. More details are currently available on Twitter. User WolfSec0x0 states that MeshAgent was circulated via two poker tools.
2/2
I would name and shame both software vendors if they were not actively responding/working on things on their end.From the info I have, no current versions of either software is still serving malicious code.
— WolfSec0x0 (@wolfsec0x0) September 29, 2026
The detailed report can be read on Pastebin. According to WolfSec0x0, MeshAgent was installed for the first time in March 2024. WolfSec0x0 says he is working with the companies that apparently unwittingly spread the trojan. If WolfSec0x0 is to be believed, the computers of around 30 players were infected. Further details are to follow.