The alleged attack reportedly did not arrive through a phishing link or an obviously suspicious download. According to Wired, it came through software that high-stakes players already trusted and regularly updated. Attackers targeting password vaults and other trusted tools have followed similar patterns in recent years.
Cybersecurity researchers believe a long-running malware campaign compromised third-party table-management tools used by online poker players, potentially affecting hundreds of accounts across GGPoker, Americas Cardroom (ACR), CoinPoker, and ClubWPT Gold. Sources cited by Wired estimated total losses at approximately $1.5 million to $4 million, though those figures remain unverified.
How the Attack Allegedly Worked
Malicious code reportedly reached players through routine software updates, bypassing the assumption that trusted tools are safe.
Compromised versions of Jurojin and IntuitiveTables, software that helps players manage multiple simultaneous poker tables, reportedly delivered MeshAgent as a hidden payload. MeshAgent is a remote-access component associated with MeshCentral, a legitimate remote-management platform, a covert approach not unlike that used in a surveillance app built to silently monitor targets. In the wrong hands, it lets an outside party view or control another person’s computer in real time.
That access allegedly gave the attacker visibility into players’ hole cards, the two private cards each player holds that opponents cannot see. Knowing an opponent’s hole cards is the defining advantage in superuser-style cheating, a category of fraud that has damaged online poker platforms before. Prior incidents typically involved compromised operator systems rather than players’ own machines.
A player identified by Wired under the pseudonym “Alex” reportedly discovered MeshAgent on his computer while investigating unusual activity. He estimated his losses from the alleged scheme at approximately $30,000.
How Platforms Responded, and How They Differed
The three major platforms named in the reporting took notably different approaches to investigation, compensation, and disclosure.
CoinPoker reportedly investigated the player as early as 2025, banned the account, and refunded more than $100,000 in allegedly stolen funds to affected players.
GGPoker banned third-party tools, introduced win-rate anomaly detection, and traced funds associated with the accused player to a Coinbase account. The operator said it shared wallet information with industry watchdogs and law enforcement, according to Wired.
ACR told players its investigation found no compromised game outcomes and said it would not issue refunds; that conclusion is ACR’s own, not an independently verified finding. ACR did announce a new screen-protection feature intended to prevent remote-viewing tools from capturing players’ cards going forward.
Cybersecurity professional WolfSec investigated the incident and, according to reporting, determined the attacker could view infected players’ screens and potentially control their machines.
Why Standard Security Advice Falls Short Here
This alleged attack exploited the trust players placed in software they had already chosen to install, not in something new or unfamiliar.
Conventional user-security advice often emphasizes avoiding phishing, suspicious links, and untrusted downloads. This attack allegedly used a different route: corrupted updates or versions of software players had already installed.
That distinction can bypass the assumptions users typically make about trusted software. Law enforcement involvement and independent hand-history audits by the platforms remain publicly unconfirmed as of the time of reporting, and no public charges or confirmed formal investigation were identified in Wired’s coverage.
Steps Players Should Take Now
Players who used the affected tools should act carefully to preserve evidence and protect their accounts.
Anyone who uses Jurojin or IntuitiveTables should update or remove those tools only according to verified instructions published directly by the vendors or the relevant poker operator. Logs and installed software should not be deleted before consulting a professional, as that evidence may be needed later.
High-stakes players should consider using a dedicated machine exclusively for poker, with current operating-system patches, updated security software, and multifactor authentication enabled. Knowing how to stay safe extends to limiting what sensitive data , browser-saved passwords, payment credentials, or crypto-wallet information , lives on that same device.
Suspected compromise requires immediate action. Disconnect the machine from the network, document any suspicious processes or unfamiliar software, contact the relevant poker operator and tool vendor, and report the incident to the appropriate cybercrime authority in your jurisdiction.
The Accountability Question Remains Open
Platforms responded differently, compensation has been inconsistent, and the broader question of who bears responsibility for affected players remains unresolved.
Platforms responded differently and compensation has been inconsistent. No public charges or confirmed formal investigation have been reported against the alleged attacker, whose identity Wired withheld because the person had not been charged. Until independent audits and clear compensation standards follow the detection work already underway, affected players face a gap that none of the platforms has yet publicly committed to close.
