A reported malware operation targeting high-stakes online poker players has prompted security changes and conflicting responses from operators. An investigation published by WIRED on October 29 alleged that compromised third-party applications allowed an attacker to view opponents’ cards through their computers, with estimated losses reaching up to $4 million.
The allegations concern Jurojin and IntuitiveTables, programs used to manage play across multiple tables. According to the investigation, compromised updates and downloads installed MeshAgent, a remote-access application capable of capturing screens and controlling affected devices. The alleged attack targeted players’ computers rather than obtaining privileged access to poker operators’ card databases.
One professional, identified by WIRED under the pseudonym Alex, discovered the software in September. He reported apparent screen-monitoring activity during poker sessions and estimated his losses at approximately $30,000. Investigators alleged that the malicious functionality was selectively activated against high-stakes players.
Winning Poker Network, which operates Americas Cardroom, reported a different conclusion from its gameplay review. Its integrity team examined more than 2 million hands associated with affected devices, including approximately 200,000 involving a scrutinized account, and said it found no evidence that opponents’ hidden cards had been exploited. The network nevertheless closed the account after considering broader investigative information.
Operators introduce capture protection and tighter software rules
WPN said its own systems, poker software, and official downloads had not been compromised. CEO Phil Nagy cautioned against treating screen-protection technology as a complete solution: “It’s another layer of protection, not a magic button.” The network also said the presence of remote-access software alone did not establish that a device had been hacked or that cheating had occurred.
As previously reported, ScreenShield will become active by default across WPN on November 4. It blocks protected table content from supported capture and sharing methods while preserving the player’s own view. Players will retain an option to disable it for streaming, recording, or coaching.
GGPoker announced a separate package of security changes on October 15. These include optional screen protection, checks for suspicious connections and processes, and a win-rate anomaly detection method designed to identify decisions that appear unusually accurate against opponents’ concealed cards. The operator also prohibited third-party poker software and automation tools, explicitly naming Jurojin and Intuitive Tables.
GGPoker said it had traced funds associated with the incident to a cryptocurrency wallet and shared its findings with Coinbase and law enforcement. WPN, meanwhile, was still evaluating broader restrictions on third-party software. Its planned ScreenShield expansion is confirmed; a network-wide prohibition on external poker tools had not been finalized.
