The trojan scandal continues to be the big topic in the poker community. Now there are new details about how the MeshAgent malware was spread.
It’s not the first trojan used by cheaters to display opponents’ hole cards. But the way the software was spread is remarkable. Legitimate poker tools were infected and, in turn, made their way onto victims’ computers.
Twitter user WolfSec0x0, who says he is working with the affected companies regarding MeshAgent, has come forward with an update:
“A couple of quick updates as coffee is being ingested:
As many of you have gleaned, Jurojin and IntuitiveTables were the two known compromised softwares. We are still learning more about the attacks.
Even though most of us that have used the malicious versions of the software, the hacker was very selective about who received the actual malicious package/files/code.
This was a hard-coded check that the compromised software made comparing your hand history folders (which have you username) to a list on their c2 server.
Basically, if you weren’t on that list, the application functioned normally and you never got infected with anything. If you WERE on the list, a number of additional files were downloaded and executed, leading to compromise.
Hopefully this helps clear up some confusion regarding the selectivity of these attacks.”
… the malicious versions of the software, the hacker was very selective about who received the actual malicious package/files/code. This was a hard-coded check that the compromised software made comparing your hand history folders (which have you username) to a list…(cont)
— WolfSec0x0 (@wolfsec0x0) September 30, 2026
Hopefully this helps clear up some confusion regarding the selectivity of these attacks.
— WolfSec0x0 (@wolfsec0x0) September 30, 2026