A recent cybersecurity attack targeting professional online poker players may have generated between $1.5 million and $4 million in illicit winnings.

The alleged scheme involved compromising third-party poker software to gain remote access to players’ computers, potentially allowing an attacker to view private cards during live games.

Online poker players are alarmed by this incident, particularly the risks associated with software used by professional players to manage multiple tables.

With more than 1,000 users potentially exposed to compromised applications, the investigation has also brought renewed attention to how poker platforms detect cheating, investigate suspicious accounts, and protect players from digital attacks.

How the Online Poker Malware Attack Allegedly Worked

The operation involved two third-party applications commonly used by professional poker players: Jurojin and IntuitiveTables.

Both programs help players manage multiple poker tables simultaneously, making them useful tools for those participating in several games at once. However, investigators found that compromised software updates allegedly provided hackers with a way into users’ computers.

The malicious updates reportedly installed MeshAgent, a remote-access tool capable of monitoring computer screens and controlling infected devices.

This access could have allowed the attacker to observe private information displayed during online poker sessions, including players’ hole cards.

In poker, knowing an opponent’s hidden cards provides an extraordinary advantage because decisions can be made with information unavailable to other participants.

Cybersecurity specialist WolfSec estimated that more than 1,000 users may have received compromised software. However, the malicious functions were reportedly activated selectively rather than against every affected user.

Hackers Allegedly Targeted High-Stakes Poker Players

The operation appears to have been more selective than a typical malware campaign.

According to the investigation, the attacker maintained a list of specific poker usernames to identify potentially profitable targets. This approach reportedly allowed the malicious software to focus on high-stakes players rather than indiscriminately monitoring every infected computer.

Jurojin confirmed that altered update packages had been distributed to a limited group of users intermittently between June 2025 and January 2026.

The alleged operation may therefore have continued for several months before its discovery became public.

One professional poker player, identified as Alex, reportedly uncovered suspicious activity in September 2026 after an AI assistant flagged unusual behavior on his computer.

Further examination revealed 11 apparent instances of screen monitoring. Ten allegedly occurred during sessions against the same suspicious opponent on Americas Cardroom (ACR).

Alex estimated that he had lost approximately $30,000.

Other professional players had also questioned the opponent’s unusually strong winning record. The alleged use of different usernames across poker platforms reportedly made it more difficult to connect the accounts and identify a consistent pattern.

Jurojin and IntuitiveTables Updates Became Part of the Investigation

The involvement of Jurojin and IntuitiveTables has highlighted a potential weakness in the software supply chain used by online poker professionals.

Instead of directly attacking poker platforms, the alleged operation exploited applications that players relied on to organize their gaming sessions.

Third-party poker tools often operate alongside official poker software. Users may trust these applications to improve their workflow without realizing that compromised updates could expose their devices to remote monitoring.

The presence of MeshAgent reportedly gave the attacker capabilities beyond simply collecting poker-related information. Remote-access software can potentially allow screen viewing and other forms of computer control, depending on its configuration and permissions.

CoinPoker and ClubWPT Gold Responded to Player Complaints

The alleged cheating operation prompted questions about how online poker operators responded to suspicious accounts and earlier warnings.

CoinPoker reportedly detected a suspicious player account in 2025, banned the account, and reimbursed affected players by more than $100,000.

ClubWPT Gold also took action after investigating a customer’s complaint. The operator suspended the account under investigation and reimbursed the player for losses associated with an affected session.

These responses demonstrated different ways poker platforms could address potential security breaches, particularly when suspicious gameplay is reported by customers.

However, the incident also exposed differences in how operators assessed evidence and determined whether suspicious results justified immediate intervention.

GGPoker Faced Criticism Over Its Initial Response

GGPoker received criticism from players who believed earlier warnings about suspicious gameplay were not addressed quickly enough.

Poker coach Patrick Howard reportedly submitted statistical evidence of unusual playing patterns in early September 2026. However, the operator allegedly informed him that the information was insufficient to justify action at that time.

Following the public disclosure of the malware operation, GGPoker announced several security measures on October 15.

The changes included restrictions on third-party poker software and the introduction of systems designed to identify unusually high win rates. The company also said it had traced suspected proceeds to a cryptocurrency wallet and contacted Coinbase.

Additionally, GGPoker reported sharing relevant information with law enforcement agencies and industry watchdogs.

The response highlighted the importance of combining technical security measures with statistical monitoring to identify potential cheating in online poker.

Americas Cardroom Disputed Claims That Game Outcomes Were Compromised

Americas Cardroom took a different position regarding the alleged incident.

On October 18, ACR informed customers that its analysis of more than two million poker hands had found no indication that game outcomes had been compromised.

Based on its investigation, the operator ruled out refunds for affected players. However, it said additional protections against screen-monitoring software would be introduced.

An attacker could allegedly obtain private information from an individual player’s computer without necessarily manipulating the poker platform’s underlying game systems.

Nevertheless, access to private cards could still create an unfair advantage, even if the cards themselves were generated and distributed correctly by the platform.

The Scandal Revives Memories of Previous Online Poker Cheating Cases

The alleged malware operation has drawn comparisons to earlier online poker scandals involving Absolute Poker and UltimateBet.

Both cases raised serious concerns about insider access to confidential game information, particularly opponents’ hole cards.

These historical incidents demonstrated how access to information that should remain private can undermine trust in online poker, regardless of whether the underlying game software functions as intended.

The 3I-style distinction between external hacking and insider misconduct is not relevant here; the central concern remains the same: players must be able to trust that their opponents cannot access hidden information through unauthorized means.

The latest allegations introduce another dimension to that problem. Instead of relying solely on access within poker platforms, attackers may exploit software installed directly on players’ computers.

Frequently Asked Questions

How did hackers allegedly cheat in online poker games?

The attackers allegedly compromised updates for third-party poker applications to install MeshAgent, a remote-access tool. This reportedly allowed them to monitor players’ computer screens and potentially view private cards during online games.

What poker software was involved in the malware attack?

The investigation identified Jurojin and IntuitiveTables, two third-party applications used by professional players to manage multiple poker tables.

What is MeshAgent malware?

MeshAgent is a remote-access tool that can provide screen-monitoring and computer-control capabilities. In the alleged poker operation, it was reportedly installed through compromised software updates.

How much money did the online poker hackers allegedly steal?

The suspected operation may have generated between $1.5 million and $4 million in illicit winnings. The amount remains an estimate rather than a confirmed total.

How many poker players may have been affected?

Cybersecurity specialist WolfSec estimated that more than 1,000 users may have received compromised software. However, the malicious functions were reportedly activated selectively against targeted players.

Did GGPoker respond to the online poker hacking scandal?

Yes. On October 15, GGPoker announced restrictions on third-party poker software, additional monitoring for unusually high win rates, and cooperation with law enforcement and industry watchdogs.

Did Americas Cardroom issue refunds to affected players?

No. On October 18, ACR stated that its review of more than two million hands found no indication that game outcomes had been compromised. It ruled out refunds but announced additional protections against screen-monitoring software.