Superuser Malware Scandal: Poker Sites Were Warned as CoinPoker Confirms Ban

Hooded hacker viewing multiple online poker tables and exposed hole cards on a laptop screen.

By Sandra Gaweda | October 5, 2026 | 5 min read

CoinPoker previously banned an account linked to the “Paul Gregg” account name, its ambassadors confirmed this week. Ambassador Patrick Leonard says it confiscated more than $100,000.
The attack hit players’ own computers through tampered updates to third-party table tools, including Jurojin and IntuitiveTables.
ACR Poker developed a “Screen Shield” designed to hide its tables from screen-capture and screen-sharing programs.

Online poker’s new superuser scandal moved fast between October 2 and October 5, 2026. CoinPoker’s ambassadors confirmed this week that the site previously banned an account tied to the attack. Ambassador Patrick Leonard says it confiscated more than $100,000. A poker coach says he warned GGPoker about the same account in September. ACR Poker has also developed a new defense for its tables. The common thread is malware hidden in tampered updates of third-party table-management tools. It allegedly let an attacker watch high-stakes players’ screens and hole cards in real time. That is a different kind of threat from the Absolute Poker and UltimateBet scandals. Here’s what happened and what US players should do now.

How the Malware Reached Players’ Computers

Jurojin Poker, a table-management tool, says an attacker intermittently swapped updates sent to a select group of users. Tampered updates sent to some users contained remote-access software. Jurojin’s current security notice says the compromised updates were delivered intermittently from June 2025 to January 2026.

The malware was built on MeshCentral, legitimate software IT teams use to manage computers remotely. A hidden “Mesh Agent” could let its controller watch a screen and operate the computer. For a poker player, that means an opponent could see your hole cards while you play.

A researcher posting as WolfSec0x0 first exposed the malware on X. The researcher initially identified 10 to 30 affected computers across Europe, North America and Oceania. The attacker allegedly targeted around 30 high-stakes players.

In its statement, Jurojin called it “a highly targeted operation, not a mass attack” by a “known cheater.” Jurojin said the same actor targeted several apps, including IntuitiveTables. The actor also ran phishing sites impersonating poker rooms and poker tools.

Jurojin says it contacted affected customers and shared information with law enforcement and poker-site security teams. Neither company has been accused of knowingly taking part.

How This Differs From the Absolute Poker and UltimateBet Superusers

The word “superuser” comes from poker’s worst cheating cases. In 2007, players on TwoPlusTwo exposed the “Potripper” account on Absolute Poker. Absolute acknowledged that seven accounts cheated over 40 days and promised $1.6 million in refunds. At UltimateBet, Russ Hamilton was identified as the primary offender.

Those cheaters exploited access to the poker sites’ own systems. You can read more about that history in our guide to online poker rigging myths and the real superuser cases.

This scandal works differently. The reporting so far centers on players’ computers and the tools installed on them. The poker client can run exactly as designed while someone else watches your screen. That shifts part of the security burden onto the software players choose to install.

The “Paul Gregg” Account and CoinPoker’s Ban

An account using the name “Paul Gregg” was among the accounts linked to the attack. Players had flagged it before the story went public. Reports refer only to the account name, so treat it as a screen name rather than an identified person.

Two poker sites were reportedly warned about the account before the scandal became public. CoinPoker ambassador Patrick Leonard said the site had previously banned an account called “Europe” registered under the same name. Leonard said CoinPoker confiscated more than $100,000 and reimbursed affected players. CoinPoker ambassador Mario Mosböck also said its security team caught the account, confiscated $100,000 and banned it.

CoinPoker is not regulated by a US state gaming authority. On unregulated sites, players depend largely on the operator’s own security and goodwill, one of the key risks of offshore poker sites.

Leonard also said around 100 players voiced suspicions to poker sites years ago. He said the same person continued playing on other sites despite those suspicions. “The future of online poker is in the hands of the sites,” he wrote.

GGPoker Received a Warning in September

Patrick Howard, a coach at Mobius Poker, sent GGPoker a report in September on the account’s suspicious results. He did not accuse it of cheating. He asked GGPoker to investigate, and later said on X that GGPoker reached out about the investigation.

Player Ignacio Morón claims he lost between $150,000 and $200,000 to the account. That includes about $60,000 in a single 15-minute session. Howard said the scandal “will change online poker forever.”

It remains unclear how many sites were affected. Our breakdown of how online poker sites detect cheating explains how security teams review suspicious results. This case shows why those reviews matter when players raise a flag.

ACR Poker’s Screen Shield

ACR Poker has developed a “Screen Shield” designed to hide its tables from screen-capture and screen-sharing programs. The idea targets exactly what the Mesh Agent did: watching a player’s screen. If remote software can’t capture the table, it can’t show anyone your cards.

The reporting doesn’t say how the feature performs against this specific malware. Still, it is a concrete step from a major site. Our ACR Poker review covers the site’s software, games and banking in more detail.

Practical Steps for US Online Poker Players

Download poker tools only from the developer’s official site, since the attacker ran phishing sites posing as poker tools.
Check your computer for remote-access programs you didn’t install, and remove any you can’t explain.
Report suspicious results to the site’s security team, with hand histories and dates.
Judge sites by how they respond to cheating reports, including bans, refunds and clear communication.

A New Kind of Threat for Online Poker

For US players, this scandal changes where the risk sits. The danger came through tools on players’ own computers. Every app you install next to your poker client now deserves the same scrutiny as the site itself. Site responses also matter. CoinPoker’s ambassadors say the site previously banned the account and reimbursed players. Still, Leonard says players raised suspicions with sites years earlier. ACR responded with new software protection. Before you sit down, check your tools, then check how your site handles security. Your hole cards should stay yours.

Sandra is a content writer and editor specializing in online poker and iGaming. She covers poker sites, game formats, industry news, and US online poker laws for Legal US Poker Sites.