Poker malware scheme may have netted up to $4M from high-stakes online players, WIRED probe finds

A hacking operation aimed at high-stakes online poker players may have produced between $1.5 million and $4 million in illicit winnings, according to an investigation by WIRED. The attacker is alleged to have gained access to players' computers and viewed their private cards during games, using compromised poker software.

The two programs involved were Jurojin and IntuitiveTables, third-party tools that let professionals play several tables at once. Their software updates were reportedly hijacked to install MeshAgent, a remote-access tool able to watch screens and take control of infected machines. Cybersecurity specialist WolfSec said more than 1,000 users could have received compromised software, although the malicious functions were switched on selectively. The attacker allegedly kept a list of targeted poker usernames to pick out high-stakes players before deploying further malware. Jurojin confirmed that altered update packages went to a small subset of users intermittently between June 2025 and January 2026.

A professional player identified only as Alex found the malware in September 2026 after an AI assistant flagged suspicious activity on his computer. He identified 11 apparent cases of screen monitoring, 10 of them during sessions against the same opponent on Americas Cardroom. He estimates his losses at about $30,000. Other professionals had also questioned the opponent's winning record, and the player is said to have used different usernames on different platforms, which made linking the accounts difficult.

Operators have responded differently. CoinPoker said it detected the suspicious account in 2025, banned it and reimbursed more than $100,000 to affected players. ClubWPT Gold suspended the account after a complaint and refunded the customer's losses from an affected session. GGPoker drew criticism from players who said it did not act quickly on their warnings; coach Patrick Howard said he submitted statistical evidence in early September 2026 and was told it was not enough to act on at that point.

On October 15, GGPoker announced security changes after the operation became public, including a ban on third-party poker software and systems to detect abnormally high win rates. It said it had traced suspected proceeds to a cryptocurrency wallet and contacted Coinbase, and had passed information to law enforcement and industry watchdogs. On October 18, ACR told customers that its review of more than two million hands showed no sign that game outcomes had been compromised. It ruled out refunds but said it would add protection against screen-monitoring software.

The case has revived long-standing concerns about online poker integrity, recalling earlier scandals at Absolute Poker and UltimateBet, where insiders could see opponents' hole cards.