WIRED details how a hacker allegedly saw high-stakes players' hole cards, and how each poker site responded

WIRED published a long investigation on Thursday, Oct 29, into the "superuser" scandal that has hung over high-stakes online poker since late September. The story, by Ben Dowsett, describes how remote-access software allegedly got onto top players' computers through hacked updates of two popular poker tools, and how it let the accused cheater see their hole cards. It also compares how each poker site handled it. We covered the start of the scandal in our Oct 16 story on GGPoker's tool ban. This is what's new.

WIRED doesn't name the accused player because they haven't been charged with a crime, and says the player didn't answer several requests for comment. We don't name them either.

How it was found

According to WIRED, a high-stakes online pro it calls "Alex" (a pseudonym) was using an AI agent, Anthropic's Claude, to review his playing stats on Sep 25, 2026. The agent spotted a program called MeshAgent running in the background. It could capture his screen and control his computer, and it had been installed on April 24 without his knowledge.

WIRED says the agent found 11 time-stamped moments when the program had been capturing his screen. All 11 were during sessions on ACR (Americas Cardroom), and Alex told WIRED the same opponent, playing as "OxOO", was at his table in 10 of them. Alex says he lost about $30,000.

A security consultant who goes by WolfSec, and who first posted about the hack on X on Sep 29, told WIRED the attacker seemed patient. He believes the same person tried to get into players' machines as early as 2022 with a simpler method.

How the malware got in

The attacker didn't go after players one at a time. WolfSec told WIRED the attacker compromised two multi-tabling tools, Jurojin and IntuitiveTables, and pushed malicious software to an estimated thousand-plus users.

• Jurojin: the attacker got into the developer's own update system, so the remote-access agent arrived through normal automatic updates.
• IntuitiveTables: its developer ran Jurojin on a test computer, which picked up the agent. The attacker then used it to add malicious code to an IntuitiveTables build before the developer signed it, and that build went up as a public download.

Because both came through official channels, neither players nor their antivirus noticed, WIRED reports. The bad build worked normally for most people. It checked the player's username against a list on the attacker's server, and only players on the list, mostly regular high-stakes players, got the extra files that installed MeshAgent. Both vendors confirmed their builds had been compromised, PokerTube reported on Oct 1.

WIRED says "hundreds of players" were allegedly targeted over several years. That's more than the 10 to 30 affected PCs WolfSec estimated when he first posted about it in late September, as PokerTube reported at the time.

How much was taken

The sources WIRED spoke to estimate the accused cheater took between $1.5 million and $4 million on GGPoker and ACR before being stopped in late September. Those are estimates from players and consultants, not figures from the sites.

What each site did, per WIRED

• CoinPoker started looking at the player in 2025, banned them and refunded more than $100,000 to affected players, CoinPoker ambassador Mario Mosböck told WIRED. He said the refunds were delayed for months because the player appealed to regulators. CoinPoker also says it held a webcam security interview with the player in February 2025 and passed its findings to ACR without getting a reply. CoinPoker is one of the sites we link to, and we earn a commission if you sign up there through our links.
• ClubWPT Gold banned the account a pro called "Mike" played heads-up against in June 2026 and refunded his losses after the hack became public, Randy Lundy, its head of customer operations, told WIRED.
• GGPoker: coach Patrick Howard of Mobius Poker told WIRED he sent GGPoker a report on the account in early September and got no answer until after WolfSec's post, when GGPoker told him there "wasn't conclusive evidence" to act. GGPoker didn't reply to WIRED. In its Oct 15 security post, GGPoker said it traced the funds to a crypto wallet, asked Coinbase to restrict the account it believes the funds were sent to and preserve its records, and reported the wallet addresses to law enforcement and to industry networks that track illicit funds.
• ACR didn't reply to WIRED. WIRED reports that ACR emailed players on Oct 18 saying its security team found no compromised game outcomes or wrongdoing and that it won't issue refunds.

ACR's side

In an Oct 16 press release, ACR said its network, the Winning Poker Network (WPN), reviewed more than 2 million hands from players whose computers had MeshAgent detected. It found no evidence that anyone in the review used knowledge of other players' hole cards on WPN. ACR said it closed the account of the player who drew the community's attention on separate game-integrity and risk-management grounds, and that the closure is separate from the hole-card finding.

ACR also says its ScreenShield feature, which blocks screen-capture and screen-sharing tools from seeing your tables, will be on by default for every WPN player from Wednesday, Nov 4. Players who stream, record or work with a coach can switch it off in settings. WPN is also considering, but hasn't adopted, a ban on third-party software running alongside its client, per the release and Poker Shield.

What else has happened

• Jurojin and IntuitiveTables (on its Discord) released tools that check whether a computer was affected, WIRED reports.
• AceGuardian, a research group within the anti-cheating company A5 Labs, released an open-source "superuser detection" tool that any poker site can use.
• WolfSec says he filed a complaint with the FBI's Internet Crime Complaint Center. The FBI wouldn't confirm to WIRED that it received it.

What it means if you play online

The lesson from this case is that a trusted tool's update can be the way in. Check your computer for remote-access or screen-sharing programs you didn't install yourself, and remove them. If you used Jurojin or IntuitiveTables, run the check tools their makers released. If your site offers a screen-protection setting, like GGPoker's Screen Guard or ACR's ScreenShield, turn it on. If you think you played against the accounts involved, contact the site's security team in writing and keep a copy.