::Cybersecurity professional, poker enthusiast:: Reported on 2026 Poker Software Supply Chain Attack
Joined September 2022
- Tweets137
- Following122
- Followers1.6K
- Likes72
Pinned Tweet
⚠️ Online poker players: we've confirmed a covert remote-access agent planted on players' Windows PCs through compromised poker software.
Current estimate: ~30 users affected, in several countries across Europe, North America and Oceania.
Details and checks below 🧵
wired.com/story/a-hacker-tar…
Give this a read! I think it does a great job of giving an overview of all the recent poker hacking drama. Great job by the @WIRED team.
#PHP2Shell, or as I like to think of it, #2026Log4J
I expect a lot more of this over the next year, #blueteam defenders are going to be losing a lot of sleep.
Ok final details before I go back to enjoying my family vacay-
/ ⚠️ ACR/WPN players: on Oct 15 a table-chat exploit let malicious messages run code on desktop-client users' PCs, no click needed. It's now patched, but anything stolen or installed is still there.
2/ Were you exposed?
3/ Check 1: Windows Security → Protection history. Look for Trojan:Win32/Commando.A!ml or anything flagged on Oct 15.
4/ Check 2: Look for PowerShell running when you didn't open it. Also look for startup entries or scheduled tasks that launch PowerShell or a URL you don't recognize.
5/ Check 3: Search your DNS and PowerShell logs for pinggy-free[.]link and trycloudflare[.]com. Then check your email for login or reset alerts you didn't trigger, and review your cashier history.
6/ Any hit: disconnect the PC. From a clean device, change your ACR and email passwords, turn on 2FA, and contact support, then reinstall Windows. Played Oct 15 but came up clean? Change your password anyway.
From @WPN_CEO @ACR_POKER
Keep in mind this does not mean that players computers were not compromised. Recommend everyone does their own security check via the instructions I posted
Poker sites need to remove dead/old code, sanitize ANY input options, and conduct real security reviews. This type of vulnerability is very similar to the ones I reported to @CoinPoker_OFF back when they launched their new client!
WPN REMOTE CODE EXECUTION:
Like I said, I am on vacation so really have limited service and ability to do analysis - from what I’ve seen, it looks like WPN clients have/had a vuln in some old code that enabled attacker to push remote commands to players.
WPN is aware of this and pushed out fixing updates, unsure of effectiveness.
Many players received encoded powershell commands that were blocked by some antivirus software. It reached out to a number of servers and IPs to download the actual malware
I’ll try to get as much reported as possible today. A number of guys are reaching out to me right now showing that they too were hacked.
Instructions to look Using Claude code:
1. backup any powershell logs that could contain evidence of command execution
2. Search for encoded powershell commands that ran as a child of the wpn client
3. Look for any connection to the following: fotav-…pinggy-free[.]link:34829/wps 11 142.249.144[.]197
asjgx-…pinggy-free[.]link:37805/wps 5 142.249.144[.]197
fvgrb-…pinggy-free[.]link:32889/wps 2 142.249.144[.]197
yipov-…pinggy-free[.]link:34291/wps 2 142.249.144[.]197
playlist-…-tcp.trycloudflare[.]com/wps 8 hidden (Cloudflare)
WPN / ACR was compromised in some way to the point that it started serving many players malware. Anyone that’s played on WPN or any of its skins over the last week need to be aware that they may have been popped.
This is still early in the investigation and I’m on vacation (1/2)
(2/2) so I will not have the ability to deep dive until I get back.
Poker players and those that conducts financial transactions online - this is your wake up moment - you are low hanging fruit and a major target for financially motivated threat actors.
@ACR_POKER @WPN_CEO
Since I"m seeing a lot of questions about this:
When the number ~30 was given with the initial report/tweet, this was the CONFIRMED number of players that had found MeshAgent running on their boxes.
Since then, a much larger number of players have been found via ... (Continued)
This quoted post is unavailable.
... Poker sites (WPN, COIN, WPT, etc) have sent emails if they have any record of you having MeshAgent on your computer while playing.
Without getting access to every single players triage results, I cannot say for certain where/how they were infected...(cont)
WolfSec0x0 retweeted
People keep asking what's new here.
Old ratting cases: victim gets tricked into opening a file, or someone gets physical access to their laptop.
This one: the hacker compromised Jurojin and Intuitive Tables, so official versions of both carried his code. It read your screen name from your hand histories and only infected you if you were on his list.
A couple of quick updates as coffee is being ingested:
As many of you have gleaned, Jurojin and IntuitiveTables were the two known compromised softwares.
We are still learning more about the attacks.
Even though most of us that have used.... (continued in reply)
... On their c2 server. Basically, if you weren't on that list, the application functioned normally and you never got infected with anything. If you WERE on the list, a number of additional files were downloaded and executed, leading to compromise.
WolfSec0x0 retweeted
Hi everyone! We're looking into the @wolfsec0x0 report in depth, working with him and sharing everything we find. Based on his version, we've made a quick tool (signed) that checks whether your PC is affected. Download it here: jurojinpoker.com/meshcheck/d…