What is happening now is that a rogue third party sends to your computer a forged packed, with it origin IP address spoofed to appear originating from the server, when it is not. The packed contains a request that you connect to an attacker-controlled server, which will accept any inbound connection regardless of credentials. Once the connection is established, it will then issue you new work, that your miner will happily solve, only, it's the attacker that will keep the profit, until you realise something's going on.