Poker Malware Scandal: How Hacked Multi-Tabling Tools Exposed High-Stakes Hole Cards

Published on November 7th, 2026

Illustration of an online poker game targeted by malware, showing exposed hole cards, compromised software updates and a hacker in the background.

Key Details

Compromised updates to the multi-tabling tools Jurojin and IntuitiveTables installed remote-access malware that exposed targeted players’ hole cards.
Sources told WIRED the attacker won an estimated $1.5 million to $4 million.
CoinPoker and ClubWPT Gold reimbursed affected players, while ACR ruled out refunds and GGPoker faced criticism for a slow response.

Hackers used compromised updates to two poker tools, Jurojin and IntuitiveTables, to spy on high-stakes players and see their hole cards. According to an October 29 investigation by WIRED, the attacker may have won between $1.5 million and $4 million.

The attack targeted software players use to manage multiple poker tables, not the poker sites themselves. Operators responded differently. CoinPoker and ClubWPT Gold refunded affected players, GGPoker tightened its security rules, and ACR refused refunds. Here’s what US players should know and how to stay safe.

How the Jurojin and IntuitiveTables Malware Worked

Multi-tabling tools help players manage several poker tables at once. According to GamblingNews, hackers used compromised updates to Jurojin and IntuitiveTables to install MeshAgent, software that lets someone remotely view and control a computer.

This allowed the attacker to see players’ screens, including their hole cards.

Cybersecurity researcher WolfSec estimated that more than 1,000 users may have received compromised software, although only a small number of high-stakes players appear to have had their hole cards exposed. Jurojin confirmed that compromised updates reached some users between June 2025 and January 2026.

How One Pro Uncovered the Hole-Card Leak

According to GamblingNews, a high-stakes poker player known as “Alex” discovered the malware in September 2026 after an AI assistant flagged suspicious activity. He found 11 possible cases of screen monitoring, including 10 during games against the same opponent on Americas Cardroom (ACR).

Alex estimates he lost around $30,000. The suspected cheater reportedly used different usernames across poker sites, making the activity harder to track.

Jurojin also reported that the attacker created fake login pages for several poker sites, including ACR, GGPoker, Bodog and Ignition, to steal player information. The company notified potentially affected users and shared its findings with cybersecurity experts and law enforcement.

How CoinPoker, ClubWPT Gold, GGPoker and ACR Responded

GGPoker, ACR, CoinPoker and ClubWPT Gold were among the poker sites affected by the malware scandal, according to WIRED. Each operator handled the situation differently.

CoinPoker banned a suspicious account in 2025 and refunded more than $100,000 to affected players. ClubWPT Gold also suspended a suspected cheater and refunded a player for losses during an affected session.

GGPoker faced criticism for its slow response. Poker coach Patrick Howard said he reported suspicious activity in September 2026, but GGPoker initially told him there wasn’t enough evidence to act. On October 15, GGPoker banned third-party poker software and introduced stronger cheating detection measures. It also reported tracking suspected funds to a crypto wallet and sharing information with authorities.

ACR’s parent network, Winning Poker Network, reviewed more than 2 million hands and said it found no evidence that players had used stolen hole-card information to cheat. ACR ruled out refunds but promised additional protection against screen monitoring.

The case shows that even when a poker site’s software isn’t hacked, players can still be exposed through third-party tools. It also raises questions about how operators handle cheating complaints and reimburse affected players. LFor more information about the site, see our Americas Cardroom review.

Why This Echoes the Absolute Poker and UltimateBet Superuser Scandals

The malware attack is similar to the Absolute Poker and UltimateBet cheating scandals, where insiders could see other players’ hole cards. The difference is how it happened. Those earlier scandals involved access to poker site systems, while this attack used software installed on players’ computers.

Incidents like these raise concerns about whether online poker is rigged. Our guide to online poker cheating explains the different ways players can be cheated and what warning signs to watch for.

How to Protect Yourself From Poker Malware

Poker sites are responsible for keeping their games secure, but players should also be careful about the software they install. Here are a few ways to protect yourself:

Check your poker tools: If you’ve used Jurojin or IntuitiveTables, run their official malware detection tools.
Remove unused software: Uninstall poker tools you no longer need.
Scan your computer: Use trusted security software to check for malware or unfamiliar remote-access programs.
Enable two-factor authentication (2FA): Add an extra layer of security to your poker and email accounts.
Avoid suspicious links: Visit poker sites directly or use saved bookmarks instead of clicking unfamiliar links.
Report suspicious play: If you suspect cheating, save your hand histories and contact the poker site’s security team.

Choosing a trustworthy operator also matters. Before depositing, check our guide to the safest online poker sites to learn what to look for.

What the Malware Scandal Means for US Players

The scandal shows that online poker security goes beyond the poker site itself. Third-party tools can put players at risk, so it’s important to be careful about what you install.

It also highlights how differently operators handle cheating complaints. CoinPoker and ClubWPT Gold refunded affected players, while ACR refused. That’s worth considering when choosing where to play.

Protect your accounts, keep your software updated and report suspicious activity. For more ways to play, check out our free poker tournaments.

Sandra is a content writer and editor specializing in online poker and iGaming. She covers poker sites, game formats, industry news, and US online poker laws for Legal US Poker Sites.