Hackers Compromise Poker Apps to Spy on High-Stakes Players’ Hole Cards

A suspected cheater allegedly broke into two popular poker tools and spied on top players. The goal was to see their secret cards during live games. Players now say the losses could reach millions of dollars. Several poker sites have since changed their rules to protect players.

Poker Tools Turn Into Spy Software

High-stakes online poker players became targets of a sneaky computer attack. The attacker hid a remote-access tool called MeshAgent inside Jurojin and IntuitiveTables, two poker apps. A remote-access tool lets an outsider control a computer from far away. The attacker pushed it onto chosen computers through the apps’ normal update channels.

According to an investigation published on October 29, 2026, the tool let the attacker watch victims’ screens. The attacker could also take control of their computers. That gave the attacker a possible view of hole cards, which are the private cards each player gets during a game.

Security researcher WolfSec studied the case. WolfSec said the attacker did not target everyone. The changed software checked each username against a list stored on the attacker’s own servers. Only matching users received more harmful files. WolfSec described this as a targeted approach, not a blast sent to everyone.

The investigation reported that the attacker broke into Jurojin’s update system. The attacker also used an infected developer test computer to slip bad code into IntuitiveTables. Both apps kept working as usual. Nothing in their normal use gave the infection away. That made the infection hard for users to spot.

Jurojin later confirmed the problem in its security notice. Reports say tampered updates reached a small group of users now and then between June 2025 and January 2026. The company stressed that not everyone who got an update had an infected computer. It also said only a handful of high-stakes players had confirmed losses from playing the suspected cheater.

A Player’s AI Helper Finds the Spy Tool

The case came to light through a professional poker player. His discovery started with a simple computer problem, not a tip. The investigation calls him Alex, which is a pseudonym. On September 25, 2026, his poker database crashed.

After the crash, Alex asked an AI agent powered by Claude to check his poker statistics. The agent found MeshAgent running quietly in the background. It could capture his screen, which means it could copy what he saw during games. It could also control his computer.

Alex then dug deeper into his records. He found 11 times when the tool had captured his screen during poker sessions. An opponent with the username OxOO had played against him in 10 of those sessions. That means the opponent appeared in almost every session the tool recorded. Alex estimated that he lost about $30,000.

Other professional players also reported odd losses against an opponent. They linked those losses to accounts on more than one poker platform. Their accounts allegedly showed unusually high win rates on several poker sites. According to sources in the investigation, the scheme may have taken between $1.5 million and $4 million.

Keep in mind that these money figures are only estimates from players and investigators. Nobody has charged the person accused by the poker community with a crime. A court has not proven any of the claims.

Poker Sites Tighten Their Security

Several poker sites and software makers have reacted to the case. Each one chose a different response, and the results vary from site to site. Some paid players back, while others did not. Reports say CoinPoker banned the suspected account and returned more than $100,000 to affected players. ClubWPT Gold banned an account in a separate case. It refunded one player’s losses after an internal review.

GGPoker announced new safety steps on October 15. The site banned third-party poker tools and improved its checks for strange winning patterns. It also said it traced money linked to the accused attacker to a Coinbase account. GGPoker then contacted the exchange and asked it to keep the related records.

ACR Poker launched a feature called Screen Shield. The feature stops remote screen-capture and screen-sharing tools from showing players’ cards. ACR said its review found no changed game results. So the site will not give refunds.

Jurojin has also tightened its own security after the attack. The company now watches software downloads more closely, and it has strengthened its security controls. It also released a tool that helps users check their computers for MeshAgent.

The case shows the risks of third-party software, especially apps that need deep access to a computer. It also raises questions about how well poker sites protect players and spot cheating, as reports on the case continue. Cybersecurity incidents have also affected traditional sports, with hackers claiming to have leaked player data linked to the Asian Football Confederation.