A WIRED investigation has put the estimated losses from a malware-enabled online poker cheating operation at between $1.5 million and $4 million, based on accounts from sources familiar with the case. The alleged attacker used remote access to view the hole cards of selected high-stakes opponents, while the hacker’s account remained active on GGPoker and Americas Cardroom until late September.
The investigation found that malicious software reached more than 1,000 estimated users of the Jurojin and IntuitiveTables poker tools. Those programs are used by professional players for table management, hot keys and playing many tables at once, but the attacker activated the harmful functions only against chosen targets.
As this publication reported in October, compromised versions of the tools gave an attacker the ability to view victims’ screens and control infected computers without compromising the poker sites’ own clients. The attacker penetrated Jurojin’s update system, delivering the remote-access agent in ordinary automatic updates, then used an infected Jurojin installation on an IntuitiveTables developer’s test computer to insert malicious code into an IntuitiveTables build before it was certified and publicly released.
The normal distribution channels meant neither users nor antivirus software detected anything unusual. A modified IntuitiveTables version checked local files for poker usernames and downloaded additional malicious files only when a name matched a list held on the attacker’s servers, according to RG.org. The list appeared to focus on regular high-stakes players across several sites.
Jurojin characterised the operation as highly targeted, saying only a handful of high-stakes players were harmed while their cards were exposed, despite several people receiving tampered software. PokerNews had previously reported that about 30 high-stakes players were known to have been targeted. The discrepancy distinguishes the number of people exposed to compromised software from the smaller group said to have suffered in-game harm.
One player identified by WIRED under the pseudonym Alex found the MeshAgent remote-access software on his computer on Sept. 25 after a Claude AI agent flagged it during a review of his playing statistics. He identified 11 time-stamped screen-monitoring events, all while playing on Americas Cardroom, and the opponent OxOO appeared in 10 of those sessions. Alex estimated his own losses at about $30,000.
There is an unresolved discrepancy over the period of the Jurojin compromise. In its current security notice, Jurojin said update packages for one group of users were intermittently replaced between June 2025 and January 2026, and that no further files were uploaded after Jan. 28. Earlier statements reproduced by PokerNews and PokerStrategy instead described June 2026 as the final compromised month.
Poker sites have reached different conclusions. CoinPoker investigated and banned a suspected account in 2025, returning more than $100,000 to affected players. Americas Cardroom said on Oct. 18 that its review found no compromised game outcomes and that it would not issue refunds. Winning Poker Network said it reviewed more than 2 million hands involving computers containing MeshAgent, including roughly 200,000 linked to an account central to the allegations, and found no evidence that knowledge of hole cards had been exploited.
Americas Cardroom plans to enable its ScreenShield protection by default on Nov. 4, limiting the ability of supported screen-capture and remote-viewing software to display players’ cards.
