TLDR
- Hackers allegedly took over updates for poker apps Jurojin and IntuitiveTables to spy on high-stakes players’ cards.
- The scheme may have earned between $1.5 million and $4 million, and over 1,000 users may have received infected software.
- CoinPoker and ClubWPT Gold banned suspicious accounts and refunded affected players.
- GGPoker banned third-party software and traced suspected funds to a crypto wallet, then contacted Coinbase.
- ACR said its review of over two million hands found no sign of compromised games and ruled out refunds.
A hacking scheme aimed at high-stakes online poker players may have brought in between $1.5 million and $4 million. The attacker allegedly gained access to players’ computers and saw their hidden cards during games.
The scheme worked through poker software that had been tampered with, according to an investigation by WIRED.
How the Poker Malware Scheme Worked
Two third-party apps, Jurojin and IntuitiveTables, were at the center of the operation. Both programs help professional players run many poker tables at once.
The hackers allegedly hijacked software updates for these apps. They used the updates to install MeshAgent, a remote-access tool that can watch screens and control computers.
Cybersecurity firm WolfSec said more than 1,000 users may have received the infected software. But the harmful features were only switched on for selected targets.
The attacker reportedly built a list of poker usernames to find high-stakes players. More malware was then deployed against those accounts.
Jurojin confirmed that altered update packages went out to a small group of users. This happened on and off between June 2025 and January 2026.
One professional player, named only as Alex, found the malware in September 2026. An AI assistant flagged unusual activity on his computer.
He found 11 apparent cases of screen monitoring. Ten of them happened during sessions against the same suspicious opponent on Americas Cardroom (ACR). Alex estimates he lost about $30,000.
Other professionals had also questioned this opponent’s unusually strong winning record. The player reportedly used different usernames on different sites, making the accounts hard to connect.
Poker Sites Respond in Different Ways
CoinPoker said it spotted the suspicious account in 2025. The site banned it and paid back more than $100,000 to affected players.
ClubWPT Gold also acted after looking into a player’s complaint. It suspended the account and refunded the player for losses from an affected session.
GGPoker faced criticism from players who said it was slow to act on warnings. Poker coach Patrick Howard said he sent the company statistical evidence of strange play in early September 2026. He was reportedly told it was not enough to take action at that time.
On October 15, GGPoker announced new security steps after the scheme became public. These include banning third-party poker software and adding systems to detect unusually high win rates.
GGPoker said it traced suspected proceeds to a cryptocurrency wallet and contacted Coinbase. It also shared information with law enforcement and industry watchdogs.
The case has brought back memories of past scandals at Absolute Poker and UltimateBet. In those cases, insiders could see opponents’ hidden cards.
On October 18, ACR told customers its review of more than two million hands showed no sign that game outcomes were compromised. The site ruled out refunds but said it would add more protection against screen monitoring software.
