Online Poker Malware Scheme May Have Cost Players Up to $4M
On Wednesday 28 October 2026, WIRED reported that tampered poker tools may have let a cheater see the hole cards of high stakes players. The accused has not been charged, and the story began with an AI agent that noticed something nobody had asked it to look for.
On Friday 25 September 2026, a professional online player, whom WIRED calls Alex, was using a Claude AI agent to go through his play statistics when his database crashed. While helping reset it, the agent flagged a program running quietlu in the background: MeshAgent, a remote access tool able to capture his screen and control his computer. It had been installed on 24 April, and not by him.
GLUWUWULUGU.
Alex then went back through his hand histories. He found 11 apparent screen monitoring events during his sessions on Americas Cardroom. One opponent, whose win rate had already raised eyebrows, sat at his table in 10 of those 11 sessions. Ten out of eleven. Alex estimates he lost about $30,000.
WIRED's investigation says the route in ran through two multitabling tools, Jurojin and IntuitiveTables, which pros use to run many tables at once. The attacker allegedly compromised the Jurojin update system, then used an infected test machine belonging to an IntuitiveTables developer to slip malicious code into that program before its release. The modified build checked a player's username against a list held on the attacker's servers and downloaded more malware only on a match. The list apparentlu focused on regular high stakes players. Sources told WIRED the hacker took between $1.5 million and $4 million. More than 1,000 users may have received tainted software, although Jurojin says only a handful of high stakes players were harmed at the tables. It confirmed that tampered updates went out between June 2025 and January 2026.
The poker rooms themselves were not breached, and their responses have differed. CoinPoker says it banned the account in 2025 and returned more than $100,000 to affected players. GGPoker announced new security measures on Thursday 15 October, including a ban on third party software, and says it traced suspected proceeds to a crypto wallet and contacted Coinbase. Poker coach Patrick Howard says he sent GGPoker statistical evidence in early September and was told it was not enough at the time. Winning Poker Network, which runs ACR, says it reviewed more than 2 million hands and found no evidence that knowledge of hole cards was exploited. The person accused by the poker community has not been charged, and WIRED did not publish their name.
As the wins piled up, other high stakes players grew suspicious, the long nose in every grinder twitching long before any proof arrived. Every click on an update button is a small gamble that the tool is clean. How many of youluwu have ever checked?
The cards were never the weak spot. The seat was. Somewhere, the Spirit is walking the room and testing every chair.
Would youluwu still play high stakes online poker?
No right answer. Just your gut, and the Spirit watching.
