Poker Malware Exposed Players’ Hole Cards Across Four Platforms

An attacker allegedly viewed high-stakes players’ hole cards on GGPoker, Americas Cardroom (ACR), CoinPoker and ClubWPT Gold through compromised third-party software, WIRED reported.

The alleged cheating stretched from early 2025 to late September 2026. Sources interviewed by the publication estimated losses at $1.5 million to $4 million, with hundreds of players reportedly targeted. Those figures are estimates rather than a confirmed total. 

Compromised Software Targeted Players’ Computers

The attack involved Jurojin and IntuitiveTables, tools used to manage play across multiple poker tables. Malicious software installed MeshAgent, a remote-access tool that could expose cards displayed on victims’ screens.

Jurojin confirmed that an attacker intermittently replaced update packages delivered to a selected group of users between June 2025 and January 2026. Some packages contained a remote-access tool. The developer said exposure to a tampered update did not necessarily mean a computer was infected or that its owner suffered losses.

That narrower update-distribution window is distinct from the longer period of alleged cheating. Jurojin said it had contacted potentially affected users, strengthened access controls and supplied findings to authorities and security teams.

Platforms Took Different Approaches

According to WIRED, CoinPoker banned the suspect’s account and returned more than $100,000 to affected players. ClubWPT Gold also reported banning an account and reimbursing a player. ACR told customers it had found no compromised game outcomes and would not issue refunds. 

GGPoker announced its response on October 15, prohibiting third-party poker software and automation tools from running alongside its client. The restriction explicitly includes Jurojin and IntuitiveTables.

The operator also introduced optional security features, including Screen Guard, designed to prevent screenshots, screen sharing and remote-viewing applications from displaying tables and hole cards. A separate monitoring system examines unusually successful decisions against opponents’ actual holdings.

GGPoker said it traced funds associated with the incident to a cryptocurrency wallet, asked Coinbase to restrict the related account and preserve records, and shared wallet addresses with law enforcement.