I spent the better part of the day investigating this issue.
- It's not a pool side hack - No pool servers are or were compromised
- It's not a pool-side close network hack - No datacenter infrastructure is compromised
- It only affects certain clients, is not pool wide, and affects affected clients repeatedly
Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.
Might be useful to post some info so people can identify themselves as affected. Is there any clear and easy way for people to know they are affected. Then the list of kit people use might be useful.