Online Poker Superuser Scandal: Malware Exposed High-Stakes Players' Hole Cards — Here's How to Stay Safe
Updated on October 7, 2026.
Malware hidden in updates for two third-party online poker tools, Jurojin Poker and IntuitiveTables, gave a cheater remote access to the screens of high-stakes players. In practice, he could see the victims’ hole cards. Wherever you play from, the takeaway is simple: the risk wasn’t in the poker room but in software installed on players’ own computers.
Quick summary
- The attack hit around 30 high-stakes players, with 10 to 30 computers identified in Europe, North America and Oceania.
- The tampered updates were sent out on and off starting in June 2025, according to Jurojin itself.
- The tool used was Mesh Agent, from MeshCentral, a legitimate remote-access program.
- The suspicious account used the name Paul Gregg and shows up in reports linked to GGPoker, CoinPoker and ACR.
- CoinPoker says it banned the account and confiscated more than $100,000. ACR rolled out a screen-capture block.
What happened
The case gained traction in late September, after the security researcher known as WolfSec0x0 exposed the operation on X. On October 1, Jurojin confirmed that its update system had been compromised. According to the company, an attacker swapped update packages sent to a specific group of users, and some of those packages included remote-access tools.
IntuitiveTables also confirmed it was targeted by the same attacker. Both programs are used by multi-tablers to manage table windows and hotkeys. That’s why the victims were high-stakes regulars, not recreational players.
Spanish player Ignacio Morón is the most cited case. He reports losses of between $150,000 and $200,000 across several rooms, including about $60,000 in a single 15-minute session.
Which rooms are involved
No room had its own system breached, based on what has been disclosed so far. But the suspicious account played on more than one of them:
- GGPoker: coach Patrick Howard says he sent the room an analysis in September showing abnormal stats on the Paul Gregg account. The room confirmed he got in touch but hasn’t shared any conclusions.
- CoinPoker: according to ambassadors Patrick Leonard and Mario Mosböck, the room had already banned the account (which used the screen name Europe), confiscated more than $100,000 and returned funds to victims.
- ACR (WPN network): CEO Phil Nagy opened an investigation into suspicious accounts and launched Screen Shield, which blocks screen-capture and screen-sharing programs from seeing the tables.
Important: so far there’s no formal accusation or ruling from any authority against an identified person. For now, there are only the rooms’ investigations and player reports.
What this means for players everywhere
The attack was targeted, hitting a specific group of players. There’s no public report of victims outside the regions already identified. Even so, the case exposes a weak point that applies to any player: anything running on your computer while you play can see your screen. That includes HUDs, table managers, solvers running in the background and browser extensions.
Another detail: according to PokerNews, the attackers also used fake websites that imitated poker rooms. Anyone who downloads a room’s client or tools through links from groups, ads or private messages is at higher risk. Before choosing where to play, check out our list of the best online poker sites and only download a room’s client from its official website.
If you play in app-based clubs, the same precautions apply. We explain how these clubs work in our guide to PPPoker and PokerBros.
What to do now
- Only update poker software through the developer’s official website. Avoid installers sent by third parties.
- On Windows, open the list of installed programs and running services. Look for Mesh Agent, MeshCentral or any remote-access tool you don’t recognize.
- Run a scan with up-to-date antivirus software and turn on two-factor authentication for your poker room account and your email.
- If you use Jurojin or IntuitiveTables, check the official announcements and, if in doubt, change your passwords from a different device.
- If you notice something odd, like an opponent who gets every decision right against you, save the hand histories and open a support ticket with the room.
- Protect your wallet too. If you deposit with crypto, review the tips in our guide on how to deposit and withdraw Bitcoin in online poker.
Terms like HUD, bb/100 and showdown are explained in our poker dictionary and calculator guide.
Chat with us on Telegram
Still have questions about security, rooms or rakeback? Send us a message on Telegram. We reply in English.
FAQ
What is a superuser in online poker?
It's someone who plays while seeing opponents' hole cards. In older cases, the flaw was in the site itself. In this case, according to the reports, the access came from malware installed on the victims' computers.
Were players on GGPoker, CoinPoker or ACR affected?
The reports describe a targeted attack on around 30 high-stakes players, with 10 to 30 computers identified in Europe, North America and Oceania. There's no public report of victims outside those regions so far.
Do I need to uninstall Jurojin or IntuitiveTables?
Jurojin says it has strengthened the security of its updates and contacted the users it believes were affected. If you use either of these tools, only update through the official website, run an antivirus scan and look for remote-access programs you didn't install, such as Mesh Agent.
Will I get a refund if I was a victim?
It depends on the room. CoinPoker says it confiscated more than $100,000 from the suspicious account and returned money to victims. The other rooms haven't announced a refund policy for this case yet.
Sources
- PokerNews: Poker Sites Were Warned About Suspicious Account
- PokerStrategy: Paul Gregg is the suspect in the superuser scandal
- Casino.org: Online Poker Hit by New Superuser Scandal
- PokerHeaven: Third-Party Poker Software Targeted in New Security Scandal
- GamblingNews: Poker Sites Warned Over Link to Online Poker Cheating Scandal
This article is for informational purposes only and is not technical, legal or financial advice.
Play responsibly. 18+ only, and check the legal age where you live.
Who writes this
The RakebackPokerWorld team: professional poker affiliates since 2017, more than 20,000 players helped. We test rooms, payments and rakeback before recommending them.
