Online poker operators took sharply different approaches to an alleged malware-enabled cheating operation that used compromised third-party table-management tools to view selected opponents’ screens and, potentially, their private cards.
The campaign did not require a breach of poker sites’ own software. According to WIRED’s investigation, an attacker compromised the Jurojin and IntuitiveTables utilities, distributing the MeshAgent remote-administration program through normal updates and an official software release. The modified IntuitiveTables program allegedly activated additional malicious files only for usernames on an attacker-controlled list, allowing the operation to focus on selected high-stakes targets.
The distribution reached more than 1,000 estimated users, although the alleged malicious functions were selectively used. WIRED’s sources estimated losses on GGPoker and ACR, also known as Americas Cardroom, at between $1.5 million and $4 million by late September. The overall number of confirmed victims, final losses and any official investigation remain unknown.
One player, identified as Alex, found MeshAgent on his computer on Sept. 25 while reviewing his statistics after a database crash. He identified 11 apparent screen-capture events while playing on ACR; the opponent using the OxOO handle was at his table in 10 of those sessions. Alex estimated his own loss at about $30,000.
CoinPoker had begun investigating a suspected player as early as 2025, banned that player and returned more than $100,000 to affected customers. ClubWPT Gold also banned an account and refunded a player’s losses after the public disclosure. Those actions contrast with GGPoker’s response to a complaint lodged in early September: it said there was not conclusive evidence to act at that point.
GGPoker announced changes on Oct. 15, including a ban on third-party tools and win-rate anomaly detection. It also said it had traced the accused attacker’s funds to a Coinbase account, asked the exchange to restrict it and preserve records, and shared wallet addresses with law enforcement and industry watchdogs.
ACR said on Oct. 18 that its security team had found no compromised game outcomes or wrongdoing and that it would not refund players. Casino.org reported that Winning Poker Network examined more than 2 million hands involving players whose computers contained MeshAgent, including about 200,000 hands involving an account central to the allegations, and found no evidence of hole-card knowledge being used in the reviewed hands.
ACR later closed the suspected player’s account after receiving additional information from other operators. The network had already introduced its Screen Shield protection for identified users after the disclosure, as we reported in September; ACR planned to turn it on by default on Nov. 4 to prevent supported remote-viewing and screen-capture tools from displaying cards.
The tool vendors also responded directly to the endpoint compromise. Jurojin and IntuitiveTables released checks to help users identify affected machines, while AceGuardian published open-source software intended to flag suspicious patterns in completed poker hand histories for human review.
WolfSec submitted a complaint to the FBI’s Internet Crime Complaint Center, but the FBI did not confirm whether it had received the report or provide further details.
