Poker Malware Hack May Have Netted $1.5M to $4M
A hack that let someone see the private hole cards of high-stakes online poker players may have pulled in somewhere between $1.5 million and $4 million in illicit winnings. It ran through tampered updates to two popular third-party multi-tabling apps, Jurojin and IntuitiveTables. More than 1,000 users may have been exposed before anyone caught on.
The mechanics matter more than the headline number. Investigators say the attacker hijacked the update process for both programs and pushed out MeshAgent, a remote-access tool that can capture screens and control an infected machine. Both apps are built for pros grinding many tables at once. Which means the people running them are exactly the players worth spying on.
Activation was selective. On most machines the malicious code sat dormant, switched on only for a list of targeted poker usernames, apparently compiled in advance to separate the big-stakes accounts from the small ones. Jurojin has confirmed that altered update packages went to a small subset of users, intermittently, between June 2025 and January 2026. Not a single hit, then. A campaign spread across roughly seven months.
One pro, identified as Alex, found the malware in September 2026 after an AI assistant flagged odd activity on his computer. He counted 11 apparent instances of screen monitoring. Ten of them came during sessions against the same suspicious opponent on Americas Cardroom. His estimated loss: about $30,000. Other professionals had already raised questions about that opponent's unusually strong record, and the player is said to have used different usernames across platforms, which made the accounts hard to connect.
Operator responses have split sharply. CoinPoker says it spotted the suspicious account in 2025, banned it and reimbursed more than $100,000 to affected players. ClubWPT Gold suspended the account after investigating a player complaint and paid back the losses from the affected session. GGPoker, by contrast, has drawn criticism from players who say warnings went unanswered. Poker coach Patrick Howard submitted statistical evidence of strange play in early September 2026 and was told the information wasn't enough to act on at the time.
On October 15, GGPoker announced security changes following public disclosure of the operation. Third-party poker software is now banned outright, and the operator said it would deploy systems to flag abnormally high win rates. It also traced suspected proceeds to a cryptocurrency wallet, contacted Coinbase, and passed information to law enforcement and industry watchdogs. ACR took a different line. On October 18 it told customers that a review of more than two million hands showed no sign game outcomes had been compromised. No refunds. It said it would add protection against screen-monitoring software instead.
The case has revived an old argument about the integrity of online poker, echoing the Absolute Poker and UltimateBet scandals, where insiders could see opponents' hole cards. The difference here is the entry point. Not a rogue employee inside the site, but a compromised update channel on players' own machines. For anyone running third-party tools, that's the detail to sit with. Check what your software is updating to, and when.