Online Poker Malware Scandal Could Have Cost Players $4M

Key Points Hackers allegedly compromised Jurojin and IntuitiveTables, using malware to view high-stakes poker players’ cards CoinPoker and ClubWPT Gold banned suspicious accounts and refunded affected players, while GGPoker faced criticism over delayed action GGPoker introduced new security measures, while ACR denied evidence of compromised games and ruled out refunds

Key Points

Hackers allegedly compromised Jurojin and IntuitiveTables, using malware to view high-stakes poker players’ cards

CoinPoker and ClubWPT Gold banned suspicious accounts and refunded affected players, while GGPoker faced criticism over delayed action

GGPoker introduced new security measures, while ACR denied evidence of compromised games and ruled out refunds

A sophisticated hack targeting big-stakes online poker players may have scored between $1.5 million and $4 million in illicit winnings. The attacker allegedly accessed the players’ computers and saw their private cards in games through compromised poker software. 

online poker players

$1.5 million and $4 million

compromised poker software

Online Poker Malware Scheme May Have Hit 1,000 Users

Two popular third-party apps, Jurojin and IntuitiveTables, were involved in the operation, according to an investigation by WIRED. Both programs enable professional players to play multiple poker tables simultaneously. The hackers allegedly hijacked their software updates to install MeshAgent, a remote-access tool that can spy on screens and control infected computers. 

Jurojin

IntuitiveTables

MeshAgent

Potentially more than 1,000 users could have received compromised software, cybersecurity specialist WolfSec said. However, the malicious functions were activated selectively. The attacker reportedly created a list of targeted poker usernames to identify high-stakes players before deploying more malware. 

1,000 users

WolfSec

high-stakes players

The operation seems to have been happening for years. Jurojin confirmed that the altered update packages were sent to a small subset of users intermittently between June 2025 and January 2026. 

happening for years

Jurojin

One professional player, Alex, discovered the malware in September 2026, when an AI assistant flagged suspicious activity on his computer. He found 11 apparent cases of screen monitoring, 10 of which had taken place during sessions against the same suspicious opponent on Americas Cardroom (ACR). Alex figures he lost about $30,000. 

Americas Cardroom (ACR)

Other professionals had also challenged the opponent’s remarkable winning record. The player in question is said to have used different usernames on different platforms, making it difficult for other players to link the accounts. 

Other professionals

Poker Operators Take Different Approaches to Hacking Scandal

The inquiry has questioned the response of poker operators to warnings in the past. CoinPoker said it detected the suspicious account in 2025, banned it, and reimbursed more than $100,000 to affected players. 

CoinPoker

ClubWPT Gold also acted upon investigating a player’s complaint. The operator suspended the account and reimbursed the customer for losses incurred in an affected session. 

ClubWPT Gold

However, GGPoker faced criticism from players who said the company did not act on their warnings in a timely fashion. Poker coach Patrick Howard said he submitted statistical evidence of strange play in early September 2026. The operator reportedly told him that the information was not sufficient to take action at that time. 

GGPoker

Poker coach Patrick Howard

On October 15, GGPoker announced some security changes following the public disclosure of the malware operation. This included banning third-party poker software and implementing systems to detect abnormally high win rates. The operator also said it had tracked suspected proceeds to a cryptocurrency wallet and reached out to Coinbase. It also passed along pertinent information to law enforcement and industry watchdogs. 

GGPoker

Coinbase

ACR had a different view. On October 18, the operator told customers that its analysis of more than two million hands showed no indication that game outcomes had been compromised. It ruled out refunds but said it would offer additional protection against screen monitoring software. 

ACR

no indication

The incident has revived old concerns about the integrity of online poker, bringing to mind earlier scandals at Absolute Poker and UltimateBet, where insiders had access to their opponents’ hole cards.

integrity of online poker

Absolute Poker

UltimateBet

crime

global

poker