Online Poker Malware Scandal Could Have Cost Players $4M

A sophisticated hack targeting big-stakes online poker players may have scored between $1.5 million and $4 million in illicit winnings. The attacker allegedly accessed the players’ computers and saw their private cards in games through compromised poker software. Online Poker Malware Scheme May Have Hit 1,000 Users Two popular third-party apps, Jurojin and IntuitiveTables, were involved in the operation, according to an investigation by WIRED. Both programs enable professional players to play multiple poker tables simultaneously. The hackers allegedly hijacked their software updates to install MeshAgent, a remote-access tool that can spy on screens and control infected computers. Potentially more than 1,000 users could have received compromised software, cybersecurity specialist WolfSec said. However, the malicious functions were activated selectively. The attacker reportedly created a list of targeted poker usernames to identify high-stakes players before deploying more malware. The operation seems to have been happening for years. Jurojin confirmed that the altered update packages were sent to a small subset of users intermittently between June 2025 and January 2026. One professional player, Alex, discovered the malware in September 2026, when an AI assistant flagged suspicious activity on his computer. He found 11 apparent cases of screen monitoring, 10 of which had taken place during sessions against the same suspicious opponent on Americas Cardroom (ACR). Alex figures he lost about $30,000. Other professionals had also challenged the opponent’s remarkable winning record. The player in question is said to have used different usernames on different platforms, making it difficult for other players to link the accounts. Poker Operators Take Different Approaches to Hacking Scandal The inquiry has questioned the response of poker operators to warnings in the past. CoinPoker said it detected the suspicious account in 2025, banned it, and reimbursed more than $100,000 to affected players. ClubWPT Gold also acted upon investigating a player’s complaint. The operator suspended the account and reimbursed the customer for losses incurred in an affected session. However, GGPoker faced criticism from players who said the company did not act on their warnings in a timely fashion. Poker coach Patrick Howard said he submitted statistical evidence of strange play in early September 2026. The operator reportedly told him that the information was not sufficient to take action at that time. On October 15, GGPoker announced some security changes following the public disclosure of the malware operation. This included banning third-party poker software and implementing systems to detect abnormally high win rates. The operator also said it had tracked suspected proceeds to a cryptocurrency wallet and reached out to Coinbase. It also passed along pertinent information to law enforcement and industry watchdogs. ACR had a different view. On October 18, the operator told customers that its analysis of more than two million hands showed no indication that game outcomes had been compromised. It ruled out refunds but said it would offer additional protection against screen monitoring software. The incident has revived old concerns about the integrity of online poker, bringing to mind earlier scandals at Absolute Poker and UltimateBet, where insiders had access to their opponents’ hole cards.