GGPoker has banned third-party software that accesses game data, interacts with tables or automates actions on a player’s computer, extending the restriction to HUDs and other utilities previously permitted when they did not directly affect play.
The change is one of five security measures introduced after the recent superuser incident involving compromised poker tools. Players must fully close prohibited applications before opening the GGPoker client. Named tools include PokerTracker 4, Hold’em Manager 3, Hand2Note, DriveHUD 2, Equilab, Jurojin, Intuitive Tables, StarsCaption, Lobbyze and AutoHotkey.
The operator had allowed some third-party software that did not affect gameplay, but said such software creates another point at which player information can be exposed. Its existing Security and Ecology Policy requires players to accept the policy before playing, allows the network to scan devices for prohibited activity, and allows it to compare suspicious files against profiles of known illicit automated programs.
GGPoker has also added a Client Security area under Game Settings, with four optional protections that work while its software is open. Screen Guard can block remote viewing of the full client, all tables or selected tables, while preserving the option to allow particular tables to be viewed. It is intended to prevent screen recordings, screenshots, screen sharing and remote viewing from exposing tables and hole cards.
Connection Monitor alerts users to suspicious connections and applications, including remote-control software and proxies. Process Check lets players mark trusted programs so they do not trigger those alerts, while DNS Check looks for signs that a network’s Domain Name System has been compromised or hijacked.
A new Win-Rate Anomaly Detection system examines unusually high win rates and decisions that are correct more often than honest human play would reasonably permit, particularly where play suggests knowledge of opponents’ hole cards. The system is applied to every hand alongside existing monitoring for collusion, ghosting, botting and real-time assistance. GGPoker said testing against confirmed suspicious cases identified those cases.
The measures follow the remote-access compromise of Jurojin and IntuitiveTables builds, which we covered earlier this month. The incident allowed an attacker to view victims’ screens and potentially their hole cards; reporting on the operation said it was targeted at high-stakes opponents rather than a mass attack.
GGPoker said it had traced funds connected to the case to a cryptocurrency wallet, shared the address with Coinbase and asked for the associated account to be restricted. It also reported wallet addresses to industry networks tracking illicit funds and to law enforcement.
The operator will end support in 2027 for Windows 7, Windows 8, Windows 8.1, macOS 11 Big Sur and earlier macOS versions. Players will need at least Windows 10 or macOS 12 Monterey, a change GGPoker linked to the reduced availability of manufacturer security patches for older operating systems.
Jurojin Poker criticized the blanket prohibition, arguing that addressing security threats differs from treating the whole third-party-software ecosystem as the threat. It called instead for clear security standards, open communication and shared responsibility among operators, developers and players. GGPoker said it would continue cooperating with authorities and the wider poker community as the investigation proceeds.
