[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7_vQIH77AJCICloXTDYCeUIjxqXQ9YyAKAuJ9_9qZCs":3},{"article":4,"iocs":42,"watch_terms":45,"solutions":46,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"aa19e29d-945a-4b78-90f1-39761fdf13fa","A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards","a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-card-715f06","Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.","A hacker allegedly used malware, identified as MeshAgent, to gain unauthorized access to the computers of high-stakes online poker players. This allowed the attacker to view opponents' cards and control their machines, leading to significant financial losses for victims. The scheme was reportedly active for years across major poker sites before being uncovered.","Hacker used malware to expose poker players' cards, costing victims millions.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fa-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6adfb9e14342ac0de5548666\u002Fmaster\u002Fpass\u002FSecurity_A%20Hacker%20Snuck%20Malware%20Onto%20Online%20Poker%20Players%E2%80%99%20Computers%20That%20Let%20Him%20See%20Their%20Cards_v1.jpg","2026-10-29T10:30:00+00:00","2026-10-29T11:00:13.140354+00:00",8,[17,20,22],{"name":18,"type":19},"Claude AI agent","product",{"name":21,"type":19},"MeshAgent",{"name":23,"type":19},"Americas Cardroom","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":24,"icon":26,"name":27,"slug":28},null,"Malware","malware",[30,35,37],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":24,"icon":26,"name":27,"slug":28},{"category":38},{"id":39,"icon":26,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43],{"type":28,"value":21,"context":44},"Malware used to capture screens and control machines of poker players.",[18,21,23],{"controls":47,"vendors":123},[48,69,95],{"slug":49,"name":50,"problem":51,"products":52},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[53,61],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":70,"name":71,"problem":72,"products":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":91,"product_name":92,"url":93,"description":94},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":96,"name":97,"problem":98,"products":99},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortideceptor","FortiDeceptor","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortideceptor","Deception platform that deploys decoys to expose attacks coming from outside or inside the network.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":118,"url":121,"description":122},"thinkst-canary","Thinkst Canary","\u002Fvendor-logos\u002Fthinkst-canary.png","canary","https:\u002F\u002Fcanary.tools\u002F","Hardware, virtual and cloud honeypots that pose as servers, routers or file shares and alert the moment an attacker interacts with them.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":136},"poker-malware-scheme-exposes-cards-and-machines-for-years","Poker Malware Scheme Exposes Cards and Machines for Years","A hacker deployed MeshAgent — a legitimate remote management tool repurposed as malware — to silently infiltrate high-stakes poker players' computers, granting full visibility into their hole cards and control over their machines. The attack persisted for years because victims lacked the security awareness to detect unauthorized software running on their systems and had no meaningful endpoint monitoring in place. This matters because the financial and reputational damage was compounded by the prolonged dwell time: better endpoint hygiene and user vigilance could have caught the intrusion far sooner. The case illustrates that even non-corporate individuals handling significant financial transactions are high-value targets requiring professional-grade security practices.",[129,130,131,132,133,134,135],"CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 7: Continuous Vulnerability Management",{"MITRE ATT&CK T1566: Phishing":137,"NIST SP 800-53 SI-2: Flaw Remediation":138,"CIS Control 17: Incident Response Management":139,"CIS Control 7: Continuous Vulnerability Management":140,"CIS Control 14: Security Awareness and Skills Training":141,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":142,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":143},"Remote access malware like MeshAgent is typically delivered via phishing; recognising and resisting phishing lures is the first line of defence against this class of attack.","Keeping operating systems and security tooling fully patched would have reduced the attack surface available for the initial compromise that allowed MeshAgent to be installed.","The absence of a clear process for reporting suspicious behaviour meant the scheme ran for years; a defined incident-response procedure would have triggered earlier investigation and containment.","Continuous scanning of endpoints for known malicious or dual-use remote-management tools would have surfaced MeshAgent's presence and enabled rapid remediation long before victims suffered material financial harm.","Victims who understood how remote access malware is delivered and what indicators to look for would have been far less likely to execute or tolerate MeshAgent running undetected on their systems.","A vulnerability management programme covering endpoint software inventory would have identified the presence of an unauthorised remote-access agent and prompted its removal before significant losses occurred.","Enforcing strict controls over which processes and users can establish remote sessions would have blocked MeshAgent from operating with the privileges needed to view card data and control the machine."]