A sophisticated malware campaign may have turned high-stakes online poker into a rigged game, allegedly allowing a hidden “superuser” to watch opponents’ screens and hole cards in real time. Estimates from people familiar with the investigation put the suspected losses at between $1.5 million and $4 million across major poker platforms. The alleged attack targeted hundreds of players over multiple years, though the number of confirmed high-stakes victims appears to be considerably smaller.
The discovery began on September 25, when a professional player identified only as Alex used an AI assistant to examine a computer problem. The investigation uncovered MeshAgent, a legitimate remote-management component that appeared to have been installed without his knowledge and was capable of capturing the screen and controlling the machine. Alex found 11 apparent screen-capture events; in 10 of those sessions, the same suspicious opponent was playing at his table on ACR, also known as Americas Cardroom.
The suspected backdoor was distributed through poker utilities designed for professionals who play many tables at once. Investigators say compromised updates for Jurojin and IntuitiveTables delivered MeshAgent to selected Windows users, while filtering targets through usernames stored on the attacker’s infrastructure. Because the malicious code traveled through ordinary update channels or an apparently official software release, users and antivirus programs had little reason to flag it.
The suspected player appeared under several handles, including OxOO, JackKlompus, and Europe, while moving among ACR, CoinPoker, ClubWPT Gold, and GGPoker. CoinPoker says it banned the account and returned more than $100,000 to affected players; ClubWPT Gold likewise banned the account after reviewing a heads-up session and refunded the player involved. The alleged cheater was still active on GGPoker and ACR until late September, however, and one professional estimated his personal losses at roughly $30,000.
The fallout has exposed a sharp divide in how poker operators responded. GGPoker announced a ban on third-party poker software—including Jurojin, Intuitive Tables, PokerTracker 4, and Hold’em Manager 3—and introduced Abnormally High Win-Rate detection, which evaluates whether decisions are implausibly correct given opponents’ unseen cards. ACR told players its investigation found no compromised outcomes and said it would not issue refunds, while also announcing technology intended to block remote-viewing tools from capturing card images.
Jurojin and IntuitiveTables have released detection tools for users, and AceGuardian has published an open-source superuser-detection tool intended for use across poker sites. The cybersecurity researcher known as WolfSec says the case was submitted to the FBI’s Internet Crime Complaint Center. For players, the scandal is a reminder that game integrity depends on more than secure poker servers: trusted utilities, automatic updates, identity checks, anomaly detection, and swift action on statistical warnings are all part of the security perimeter.
