Online poker cheating malware scandal may have cost players up to $4m

High-stakes online poker players may have lost between $1.5 million and $4 million to an online poker cheating malware scandal, according to an investigation by WIRED reported by GamblingNews and Casino.org. The attacker is alleged to have seen opponents' private cards without breaching the poker sites' own systems.

How the malware reached high-stakes tables

The alleged route ran through software: Jurojin and IntuitiveTables, two programs popular with professionals who play several tables at once. According to GamblingNews, hackers allegedly hijacked their software updates to install MeshAgent, a remote-access tool able to watch a screen and control an infected machine. Jurojin confirmed that altered update packages were sent to a small subset of users, intermittently, between June 2025 and January 2026.

WolfSec, a cybersecurity specialist cited in the reporting, said more than 1,000 users may have received compromised software, though the malicious functions were activated selectively. The attacker reportedly compiled a list of targeted poker usernames to single out high-stakes players.

The most detailed account comes from a professional WIRED identified as Alex. An AI assistant flagged MeshAgent on his computer in September 2026, and he found evidence of 11 apparent screen-monitoring events. Ten of them happened during sessions against the same opponent on Americas Cardroom (ACR). Alex estimates his losses at about $30,000. Other professionals had already questioned that opponent's win rate, and the player is said to have used different usernames on different platforms.

The public evidence behind the central allegation is circumstantial: monitoring records plus an unusual win rate. Neither report contains a hand in which a card is shown to have been known in advance.

What Americas Cardroom concluded

ACR's operator, Winning Poker Network, said its integrity team examined more than 2 million hands involving players whose computers held MeshAgent, including approximately 200,000 played by the account at the center of the allegations. It found no evidence that players had used knowledge of opponents' hole cards in the hands reviewed, Casino.org reported. The finding covers the hands the team examined.

The operator told customers on October 18 that it would not issue refunds. At the same time, ACR closed the suspected player's account after considering additional information from other operators.

The same reporting says CoinPoker shared its findings about the suspected cheater with ACR and received no response. Neither report carries a public ACR comment on that claim.

CoinPoker and ClubWPT Gold paid players back

Other operators took a different line. CoinPoker detected the suspicious account in 2025, banned it and refunded more than $100,000 to affected players, according to GamblingNews. ClubWPT Gold also banned an account and reimbursed a customer for losses in an affected session.

GGPoker's handling drew criticism from players. Poker coach Patrick Howard said he submitted statistical evidence of unusual play in early September 2026 and was told the information was not sufficient to act on at the time. On October 15 GGPoker announced it would ban third-party poker software and bring in systems to detect abnormally high win rates. It said it had traced suspected proceeds to a cryptocurrency wallet, asked Coinbase to restrict the associated account and preserve its records, and passed its findings to law enforcement and industry watchdogs.

The case has revived comparisons with Absolute Poker and UltimateBet, earlier scandals in which insiders could see opponents' hole cards, GamblingNews noted.

ScreenShield arrives on November 4

Neither report names a regulator that has opened an inquiry, and neither cites a court filing. That leaves ACR's review of more than 2 million hands as the operator's answer to players who hold their own screen-monitoring records, and CoinPoker's account of an approach that went unanswered as the open question between two operators.

ACR plans to switch on ScreenShield by default on November 4. The protection limits the ability of supported screen-capture and remote-viewing tools to display players' cards, Casino.org reported.