マルウェアにより、ポーカーのイカサマ師が対戦相手のパソコン画面を覗き見ていたとされる数百人のオンラインポーカープレイヤーが金銭的被害を受けた可能性MeshAgentを使い、対局中の特定プレイヤーを監視していたとみられるオンラインポーカーのプレイヤーをめぐり、不正行為の疑惑が浮上しています。複数のオンラインギャンブルサ

Research-backed guide on Groundwork.

Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.

Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.

Centenas de jogadores profissionais de póquer online foram alegadamente alvos de uma operação prolongada de ciberespionagem que terá resultado no desvio de milh

Centenas de jogadores profissionais de póquer online foram alegadamente alvos de uma operação prolongada de ciberespionagem que terá resultado no desvio de milhões de dólares nas principais plataformas da modalidade. Através da instalação clandestina de um programa nos computadores das vítimas, um b

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

A sophisticated cyberattack targeting high-stakes online poker players has been uncovered, involving malware that allowed hackers to view players' cards and manipulate game outcomes. The attack, which spanned multiple years, utilized compromised third-party poker software applications like IntuitiveTables and Jurojin to deliver malicious code to over a thousand users. The malware, known as MeshAgent, was installed covertly on victims' computers, enabling attackers to monitor gameplay and identify high-value targets. The scheme was first detected when a professional player, using an AI agent to review game statistics, noticed suspicious activity on his system. The AI flagged MeshAgent, a program capable of screen capture and remote control, which had been active since April 2024. Further investigation revealed that the same opponent, using the handle OxOO, appeared in 10 of 11 suspicious sessions. Players' hand histories showed statistically improbable win rates, indicating cheating. The hacker employed advanced tactics, including modifying legitimate software updates to distribute the malware, and only activated the malicious payload for players on a predefined list. Despite reports from players to sites like GGPoker and CoinPoker, many platforms failed to act promptly, allowing the scheme to continue for over a year. CoinPoker proactively banned the suspected cheater based on win rate anomalies, while GGPoker initially dismissed reports. The attack reportedly resulted in millions of dollars stolen across major poker sites. In response, some platforms have implemented new security measures, including banning third-party tools and adding win-rate anomaly detection. However, the incident has raised serious concerns about the security of online poker platforms and the need for more rigorous monitoring of player behavior and software integrity.

Curate Feeds | Make Collections | Customize Email Briefs

Centenas de jogadores profissionais de póquer online foram alegadamente alvos de uma operação prolongada de ciberespionagem que terá resultado no desvio de milh

KMS Auto was abused as an initial entry point in a multi-stage intrusion that led to XMRig mining, ScreenConnect and MeshAgent remote access, and a scareware payload masquerading as ransomware. The incident was tentatively linked to APT36/Transparent Tribe, but the evidence remained inconclusive and the final payload appeared to be a hoax rather than true file-encrypting ransomware. #KMSAuto #XMRig #ScreenConnect #MeshAgent #APT36 #TransparentTribe #SecurityHealthServices.exe

Mandiant and GTIG report renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), which bypasses WAF rules by using a percent-encoded /%50SEMHUB/ path to reach Oracle PeopleSoft’s vulnerable PSEMHUB endpoint. The campaign spans multiple sectors worldwide and uses web shells, SIDEEYE via a trojanized Ple64.exe installer, Neo-reGeorg tunnels, and MeshAgent for persistence and lateral movement. #UNC6240 #ShinyHunters #CVE-2026-35273 #OraclePeopleSoft #SIDEEYE #Ple64.exe #Neo-reGeorg #MeshAgent

ShinyHunters is using a URL-encoding trick to bypass WAF rules and keep exploiting Oracle PeopleSoft CVE-2026-35273 on unpatched servers. The group is deploying web shells and backdoors to steal data, move laterally, and maintain access across multiple sectors, including higher education and government. #ShinyHunters #UNC6240 #OraclePeopleSoft #CVE-2026-35273 #SIDEEYE #Neo-reGeorg #MeshAgent

Huntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.