Malware hit high-stakes poker players via software updates
The investigation also revived scrutiny of the “Paul Gregg” account, previously flagged for suspicious activity at CoinPoker and GGPoker.
Key Takeaways
- A cyberattack distributed malware through updates to third-party poker software, targeting high-stakes players between June 2025 and January 2026, according to Jurojin Poker.
- The malware reportedly used MeshCentral, a legitimate remote-access tool, potentially letting attackers view players’ screens and expose private cards during live hands.
- Cybersecurity researcher WolfSec0x0 identified between 10 and 30 potentially affected computers across several regions.
U.S.- A cyberattack targeting high-stakes poker players has raised security concerns across the online poker industry after malware was reportedly distributed through updates to third-party poker software. Jurojin Poker confirmed that its software was affected, saying attackers pushed modified updates to some users between June 2025 and January 2026.
Another poker management tool, IntuitiveTables, was also reportedly compromised. The software is used by players who play multiple tables and automate certain functions during online games.
The malware reportedly used MeshCentral, a legitimate remote-access system that can allow someone to view and control a computer remotely. It could have given an attacker access to players’ screens and potentially exposed private cards during live hands. Cybersecurity researcher WolfSec0x0 identified between 10 and 30 potentially affected computers across several regions, Jurojin said the attack had been focused on specific high-stakes players rather than a mass attack on the poker community as a whole.
The incident has been compared to the superuser cases of the late 2000s. According to PokerNews, questions have been raised about one particular account that some players had flagged in September for allegedly unusual results.
