Online Poker Cyber Attack: Third-Party Software Provider Responds

Last Updated on October 1, 2026 by Bala Kumar

SEO Setup

Use the focus keyword in the H1, the first 100 words, one H2 and the image alt text. Keep density near 1%.

Introduction

The biggest online poker cyber attack in years did not break into a poker site. It came through the tools players trust to run beside their tables.

On 30 September 2026, Jurojin Poker confirmed that an attacker had secretly swapped its software updates for a small group of users between June 2025 and June 2026. Some of those tampered updates carried a remote-access tool that let the attacker watch victims’ screens, including their hole cards. About 30 high-stakes players are known to have been targeted.

Here is what happened, what Jurojin says it has fixed, and what every online poker player should do now.

What Happened in the Online Poker Cyber Attack

The attack hijacked trusted poker tools, not poker sites. An attacker slipped a hidden remote-access agent onto players’ Windows PCs through tampered updates of third-party table-management software, then watched their screens live.

The agent was built on MeshCentral, a legitimate open-source remote-management program. It installed as a hidden Windows service named “Mesh Agent”. Whoever ran it could see hole cards in real time and reach saved passwords, session cookies and payment cards on the PC.

GGPoker and ClubWPT Gold were named by the researcher as not involved. The poker sites themselves were not breached.

What Jurojin Poker Said

Jurojin calls it a hand-run, highly targeted operation by a known cheater, not a mass hack. Jurojin is an all-in-one multitabling tool that handles table layouts, hotkeys, bet sizing and on-table overlays.

Key points from the statement, in summary:

•           How it worked: the attacker intermittently replaced the update package sent to one specific group of users. Some of those packages carried a remote-access tool.

•           Who was behind it: a known cheater aiming mostly at high-stakes opponents, to see their hole cards. The same actor also hit IntuitiveTables and ran phishing sites posing as poker rooms and poker tools.

•           What stopped it: frequent key rotation, started before the attack was found, left the attacker unable to push further uploads.

•           New safeguards: tighter access to sensitive configuration, logging of every server download, and multi-factor authentication wherever server data is edited or deleted.

•           Evidence: Jurojin says it has logs of every compromised version and the dates each was served, and has shared reports with authorities and security teams.

•           Victims: affected users were contacted privately by email. Jurojin is working with the researcher and apologised to its customers.

No player or suspect has been officially named. Names circulating on social media remain unconfirmed.

Who Is Affected: The Numbers So Far

Roughly 10 to 30 high-stakes players were hit, but the full financial damage is still unknown.

The risk goes beyond poker. Infected PCs exposed saved browser passwords, logged-in sessions and stored cards. The attacker was also seen removing the agent remotely, so some victims may still not know.

How This Compares With Past Poker Superuser Scandals

This is the first major superuser case delivered through third-party software rather than a poker site. Earlier cases came from insiders or a flaw in a site’s own client.

The pattern repeats: players and independent researchers, not operators, spotted the cheating first. What is new is the attack surface. HUDs, table managers and other helper tools run with deep access to a player’s PC, which makes them a valuable target.

How to Protect Your Online Poker Account

If you run any third-party poker software on Windows, check your PC today. The steps below follow the checks published by the researcher and PokerStrategy.

1.         Look for “Mesh Agent” or “MeshCentral”. Open Services and Installed apps, or run the read-only PowerShell checks in the PokerStrategy guide. Traces can remain even if the attacker removed the agent.

2.         Check Windows Security exclusions. If C:\Windows is excluded and you did not add it, treat the PC as compromised.

3.         If you find it, disconnect first. Unplug the internet but keep the evidence for police and poker sites.

4.         Change passwords from a clean device. Start with your email, then poker, banking and crypto accounts.

5.         Log out of all sessions and turn on 2FA. Stolen session cookies can bypass a new password until sessions end.

6.         Replace saved cards and move crypto. Ask your bank for new cards; move funds to a wallet set up on a clean device.

7.         Report it. Tell every poker site you play on and your local cybercrime authority (in India, cybercrime.gov.in or helpline 1930).

8.         Reinstall Windows. Removing the agent alone is not enough.

Going forward, download tools only from official sites, avoid links posing as poker rooms, and keep your poker PC separate from banking and crypto where possible.

Conclusion

The Jurojin statement confirms that online poker’s newest superuser threat came through the side door. No poker site was breached, yet a single attacker could see opponents’ cards for months by poisoning the tools players trust.

The open questions now are how much money was taken, whether poker sites will refund victims, and whether the attacker will be named or charged. Check your PC, lock down your accounts, and bookmark this page for updates.

FAQs

Bala Kumar

Founder of PokerClubGames.com and a Poker Researcher with 10+ years of experience in SEO, WordPress development, and gaming content strategy. Specializes in researching online poker sites, poker apps, tournaments, bonuses, and poker strategies. Experienced in poker platform reviews, affiliate marketing, and creating SEO-focused poker content for global audiences.

For collaborations, media inquiries, or poker-related partnerships:
Contact: Info@hugecount.com