TLDR Hackers allegedly took over updates for poker apps Jurojin and IntuitiveTables to spy on high-stakes players’ cards. The scheme may have earned between $1.5 million and $4 million, and over 1,000 users may have received infected software. CoinPoker and ClubWPT Gold banned suspicious accounts and refunded affected players. GGPoker banned third-party software and traced suspected funds to a crypto wallet, then contacted Coinbase. ACR said its review of over two million hands found no sign of compromised games and ruled out refunds.
A hacking scheme aimed at high-stakes online poker players may have brought in between $1.5 million and $4 million. The attacker allegedly gained access to players’ computers and saw their hidden cards during games.
The scheme worked through poker software that had been tampered with, according to an investigation by WIRED.
How the Poker Malware Scheme Worked
Two third-party apps, Jurojin and IntuitiveTables, were at the center of the operation. Both programs help professional players run many poker tables at once.
The hackers allegedly hijacked software updates for these apps. They used the updates to install MeshAgent, a remote-access tool that can watch screens and control computers.
Cybersecurity firm WolfSec said more than 1,000 users may have received the infected software. But the harmful features were only switched on for selected targets.
The attacker reportedly built a list of poker usernames to find high-stakes players. More malware was then deployed against those accounts.
Jurojin confirmed that altered update packages went out to a small group of users. This happened on and off between June 2025 and January 2026.
One professional player, named only as Alex, found the malware in September 2026. An AI assistant flagged unusual activity on his computer.
He found 11 apparent cases of screen monitoring. Ten of them happened during sessions