An anonymous X user has alleged that a remote-access agent was installed on the Windows computers of about 30 high-stakes online poker players, potentially allowing an attacker to view hole cards and control infected machines. No poker site or player has been identified, and the claims have not been independently substantiated.
The allegations have nevertheless prompted concern across the poker community, reviving questions about online game security years after the 2000s “POTRIPPER” scandal. Security incidents and cheating accusations have continued to emerge on different poker sites since then, but no recent case has matched that scandal’s scale.
Claims of a remote-access tool
The allegations were posted by @wolfsec0x0, an account that had only 230 followers before publishing a series of posts on Tuesday. The user described themselves as a cybersecurity professional and wrote: “we've confirmed a covert remote-access agent planted on players' Windows PCs through compromised poker software.”
According to the posts, whoever operates the relevant server could watch an infected player’s screen in real time, including their hole cards, while also controlling the computer’s mouse and keyboard. The account presented a timeline that it said traced the activity back to 2024.
The alleged agent reportedly installs on a PC as a Windows service called a “Mesh Agent”. The posts said it hides its files while launching a system-level PowerShield process. The account claimed that an attacker “could see everything on screen and reach anything on the PC: browser-saved passwords, session cookies, saved cards.”
The claims did not identify the poker software involved, the affected players or the sites on which they played. @wolfsec0x0 did state that GGPoker and ClubWPT Gold were “not involved in this situation”, and said the targets were exclusively high-stakes players.
Evidence still awaited
In a separate post, the user said: “I would name and shame both software vendors if they were not actively responding/working on things on their end. From the info I have, no current versions of either software is still serving malicious code.”
The poker community is now waiting for further evidence and, potentially, a list of affected players. Todd Witteles noted on X that the compromised software described in the allegations was a third-party tool rather than online poker software.
Until additional evidence is provided, the claims remain allegations. The reported capability, if confirmed, would create risks beyond poker play, including possible exposure of stored passwords, session cookies and payment-card details.
