GGPoker bans HUDs and all third-party poker tools after the superuser scandal

GGPoker announced five new security measures on Thursday, Oct 15, 2026. The one players are arguing about is a ban on all third-party poker software and automation tools running alongside the GGPoker client. That covers trackers with heads-up displays (HUDs) such as PokerTracker 4 and Hold'em Manager 3, table managers, and even the free equity calculator Equilab. GGPoker's announcement tells players to "fully close these applications before launching GGPoker."

What GGPoker announced

• A ban on third-party tools. GGPoker says it used to permit certain third-party tools that did not affect gameplay, and that it is tightening the policy "following the recent incident". It names ten: Jurojin, PokerTracker 4, Hand2Note, Holdem Manager 3, StarsCaption, DriveHUD 2, Intuitive Tables, Lobbyze, Equilab and AutoHotkey. The list says prohibited tools "include, but are not limited to" these.
• A new Client Security section in Game Settings, with four optional features that run only while GGPoker is open. Screen Guard keeps tables out of screenshots, recordings, screen shares and remote-viewing apps. Connection Monitor flags apps with suspicious connections, such as remote-control tools or proxies. Allowed Processes lets you mark apps you trust so they don't trigger alerts. DNS Check looks for signs of DNS hijacking. Poker.org reports that the section arrives in a client update.
• Win-rate anomaly detection, which GGPoker calls WAD. For each hand, GGPoker says, its system checks whether each decision was correct given the cards the opponent actually held, and looks for players who are right "far more often than any honest playing style allows". GGPoker says it tested the method and it identified past cases.
• End of support for old operating systems in 2027: Windows 7, 8 and 8.1, and macOS 11 (Big Sur) or earlier. Players will need at least Windows 10 or macOS 12 (Monterey).
• Support for victims. GGPoker says it traced the funds from the recent incident to a crypto wallet, shared its findings with Coinbase, where it believes the funds were sent, and asked Coinbase to restrict the account and preserve its records. It says it has reported the wallet addresses to law enforcement and to industry networks that track illicit funds.

GGPoker's post doesn't say what happens to a player found running one of the banned tools.

Why now: the superuser scandal

On Sep 29, 2026, a security researcher who posts on X as @wolfsec0x0 reported that a remote-access agent had been planted on online players' Windows PCs through compromised versions of two third-party poker tools, PokerTube reported. The agent belongs to MeshCentral, a legitimate open-source remote-management product, and it gave whoever ran its server a live view of the player's screen, hole cards included, and control of the PC. The researcher estimated that 10 to 30 PCs were affected, belonging to players in Europe, North America and Oceania, and dated the earliest confirmed activity to Mar 16, 2024. The two tools were Jurojin and IntuitiveTables, and both vendors confirmed they had been compromised. The researcher found no compromise of the poker sites' own clients.

Jurojin's statement, quoted by PokerNews, called it "a highly targeted operation, not a mass attack", carried out "by a known cheater aiming at specific opponents, mostly at high stakes, with the goal of viewing their hole cards remotely." PokerNews also reported, citing the Spanish outlet Poker Red, that poker coach Patrick Howard of Mobius Poker sent GGPoker a report in September about suspicious behavior from one of the accounts involved.

Other sites moved first

Players on ACR Poker, GGPoker and CoinPoker reported being affected by accounts linked to the same player, Poker.org reported. ACR's network, WPN, contacted players on Sep 29 whose computers were running remote-access, screen-sharing or screen-control software and switched on a new feature called Screen Shield for them, which hides WPN tables from screen-capture and screen-sharing tools. According to CoinPoker ambassador Patrick Leonard, quoted by Poker.org, CoinPoker banned a linked account about a year earlier and refunded affected players. CoinPoker is one of the sites we link to, and we earn a commission if you sign up there through our links.

How players reacted

GGPoker's announcement post on X had more than 86,000 views and 60 replies by Friday morning, and the reaction split.

• Leonard, a high-stakes online pro, wrote: "Big, big changes from GG. I think they are very good, but going to change circumstances for a lot of people playing multi sites." A second post of his, missing the days of "no table management, no HUDs", drew more than 800 likes.
• The multi-site point came up again and again. The account MTT Database Review asked whether anyone who plays on several sites now has to choose between going without a HUD on sites where other players have one, or not playing anywhere but GG.
• Streamer Aaron Barone said he could understand the decision to remove HUDs, "especially when one is built into the client". His bigger problem was losing other tools: "I just want to be able to organize my tables in a coherent manner and share them with the audience on stream."
• Mobius Poker called checking win rates "the most basic integrity test there is" and asked GGPoker how an account "winning at impossible rates" kept playing for months, "including after it was reported to you in September". GGPoker replied: "WAD isn't the kind of win-rate monitoring you're thinking of. We already have that in place."
• Jurojin said it understands why GGPoker is acting, but that "there's a difference between addressing security threats and treating an entire ecosystem of third-party software as the threat itself." It asked GGPoker to reconsider and open a dialogue with the developers and players affected.

What it means if you play on GGPoker

If you play on GGPoker and on another site that allows trackers, GGPoker now wants the tracker fully closed whenever its client is running, not just paused. Poker.org points out that a tool like PokerTracker 4 is also used for bankroll tracking and reviewing your own hand histories, and that hotkey tools like AutoHotkey help players who run many tables at once, so the ban reaches honest uses too. GGPoker's Security Ecology Policy still says hand histories may be imported to track your own play, and that tools that "do not support or interact with GGPoker during gameplay will not be flagged." The new post doesn't say how those rules fit with the ban, and we haven't seen GGPoker explain it. If it does, we'll update this story with the date.