Poker tool malware exposed high-stakes players' hole cards

According to Jurojin and WIRED, an attacker slipped remote-access software into updates of two popular third-party poker tools, with the goal of seeing the hole cards of a targeted list of mostly high-stakes players. The tools are Jurojin and IntuitiveTables, both third-party multi-table programs. The poker rooms involved have responded in very different ways, from bans and refunds to a firm no on refunds, and ACR Poker will switch its ScreenShield table protection on by default from November 4.

How the attack worked

In a security notice last updated on 2 October, Jurojin says that between June 2025 and January 2026 an attacker "was able to intermittently replace the update package delivered to one specific group of Jurojin users with a tampered version", and that "some of those packages included a remote-access tool". Jurojin calls it "a highly targeted operation, not a mass attack", aimed at specific opponents "with the goal of viewing their hole cards remotely". That window refers to Jurojin's own update channel; Jurojin says nothing else was uploaded to its servers after 28 January 2026.

WIRED, in an investigation published on 29 October, names the remote-access program as MeshAgent. According to security researcher WolfSec, who first raised the alarm on X on 29 September, the IntuitiveTables developer had Jurojin on a test PC, and that machine was infected through the tampered update. WolfSec says the attacker then added malicious code to IntuitiveTables before the developer signed a new build, and that build went out as a public download. WIRED sources this route to WolfSec and does not quote the IntuitiveTables developer on it.

According to WolfSec, the tampered IntuitiveTables build only acted on usernames from a list held on the attacker's servers. WolfSec told WIRED: "If you were on a hard-coded list… then it acted as a malicious program… If you weren't on that list, then it became the normal program." WIRED says the list was made up mainly of regular high-stakes players across several sites.

How big it was

Here the accounts differ, and the numbers below are estimates, not confirmed totals.

• WolfSec estimates, via WIRED, that the tampered software reached more than 1,000 users. WIRED says hundreds of players were allegedly targeted over several years.
• Sources WIRED spoke to estimate the attacker allegedly took between $1.5 million and $4 million from players on GGPoker and ACR.
• Jurojin's view is narrower: "only a handful of high-stakes players were harmed by actually playing against the attacker while their hole cards were exposed." It adds that "exposure does not mean a device was infected."

WIRED says the player it describes has not been charged with any crime (as of 29 October), and we are not naming the person accused in community reports.

What the poker rooms say

ACR Poker / Winning Poker Network (WPN). In a 16 October release, WPN says its Game Integrity team reviewed more than 2,000,000 hands from players whose devices had MeshAgent detected "and found no evidence that any player in that review was using hole-card knowledge on WPN". It closed one account it had reviewed on separate integrity and risk-management grounds, and says that decision is separate from the hole-card finding. According to WIRED, ACR emailed players on 18 October to say it would not issue refunds.

From November 4, ScreenShield, which blocks table content from screen-capture and screen-sharing tools, will be switched on by default for ACR Poker players; WPN describes it as a network-wide standard. Players who need screen capture for streaming, coaching or recording can turn it off themselves in the client's Settings. WPN had already switched it on from 29 September for players whose devices met its detection criteria, and says ScreenShield is not "a complete answer to every cybersecurity threat". WPN is also evaluating a policy that could ban third-party software alongside its client; no decision has been made.

Separately, ACR said on 17 October that a software bug in its client had created "a potential security vulnerability", which it patched, and that it found no evidence of account compromise. ACR has not said what the bug was, or linked it to the tool updates.

GGPoker. In a 15 October blog post, GGPoker banned all third-party poker software and automation tools, including Jurojin and Intuitive Tables, and added win-rate anomaly detection to its integrity checks. It also introduced optional client security features, including Screen Guard, which keeps tables out of screenshots, screen shares and remote-viewing apps. GGPoker says it traced the funds to a crypto wallet and shared its findings "with Coinbase, where we believe the funds were deposited", asking it to restrict the account.

CoinPoker and ClubWPT Gold. According to WIRED, CoinPoker banned the account and refunded more than $100,000 to affected players, and ClubWPT Gold banned the account and refunded a player for his losses.

Our reading

In the reports above, the malware travelled in third-party tools that players run beside the poker client. ACR's separate client bug has not been linked to them. If you use Jurojin, its notice recommends a clean Windows reinstall if you received its email or saw warning signs, and offers a check tool, Jurojin Mesh Check, on jurojinpoker.com; it says "a clean result is not a guarantee". Download tools only from the developer's own site, and be wary of messages offering a "check" or a refund: Jurojin says the same actor ran phishing sites impersonating poker rooms and tools. Refunds are up to each room, and as of 31 October they differ widely.

For more on poker rooms and disputes, see Bryn Kenney's lawsuit against GGPoker's owner, 888's regulated Alberta poker launch and Norway's consultation on Norsk Tipping online poker. For a crypto-site breach, see Gamdom's hot-wallet incident.

Availability: ACR Poker, GGPoker, CoinPoker and ClubWPT Gold are not licensed in every country; whether you can play depends on where you live.