GGPoker Bans Poker Software After Malware Cheating Scandal

A cheating operation built on hacked poker software may have earned its operator between $1.5 million and $4 million, and the clean-up has now split the industry’s biggest rooms. GGPoker answered the malware campaign with a blanket ban on third-party tools, new win-rate monitoring and a referral to law enforcement. Americas Cardroom went through more than two million hands, found nothing wrong with its games and ruled out refunds entirely. Players who sat at those tables are left with four different answers from four different operators about who, if anyone, owes them money.

How the Attack Reached High-Stakes Tables

The attacker never touched a poker client. The real target was the third-party software that serious grinders run alongside it, the table managers that stack windows, assign hotkeys and keep a dozen games readable at once. Jurojin and IntuitiveTables both sat in that category, and both had their update channels hijacked so that routine upgrades quietly delivered MeshAgent, a legitimate remote-access tool that handed the intruder a live view of the screen and control of the machine behind it.

Scale estimates have climbed sharply since the first reports. Cybersecurity firm WolfSec believes more than 1,000 users may have received a compromised build, though the malicious functions only woke up for selected victims. The attacker reportedly kept a list of poker usernames and checked it before deploying anything further, which kept the operation small enough to stay invisible for years. Jurojin has since confirmed that altered update packages went out intermittently between June 2025 and January 2026. Those dates matter to GGPoker and every rival room now trying to work out which sessions the malware actually touched.

GGPoker Pays for a Slow Malware Response

Criticism of GGPoker over the malware case starts well before October. Patrick Howard, a poker coach who works with high-stakes players, sent the operator statistical evidence of abnormal play in early September 2026, and the room told him the material fell short of justifying action at that stage. Other professionals had been questioning the same opponent’s win rate for months without getting anywhere either.

Once the operation became public, GGPoker moved on the malware threat fast. On 15 October the room banned third-party poker software outright and rolled out detection systems aimed at abnormally high win rates. It also traced suspected proceeds to a cryptocurrency wallet, contacted Coinbase about the funds and passed what it had to law enforcement and industry watchdogs.

The software ban is the part that reshapes daily play. GGPoker has decided that the malware risk carried by table managers outweighs their value to the regulars who depend on them, and rival networks are weighing the same question right now. Nobody has worked out how a serious multi-tabler replaces tools they have used for a decade.

Americas Cardroom Rules Out Refunds

Americas Cardroom reached the opposite conclusion three days later. On 18 October the operator told customers that an analysis of more than two million hands turned up no indication of compromised results on its tables. It ruled out refunds and offered extra protection against screen-monitoring software instead.

At least one player disagrees. A professional identified only as Alex found the malicious software on his own computer in September 2026, after an AI assistant flagged odd activity, and counted 11 apparent screen-monitoring events. Ten of those happened during sessions against the same suspicious opponent on Americas Cardroom. He puts his losses at roughly $30,000, a figure no operator has agreed to cover.

Two Rooms Refunded Players Without Waiting

CoinPoker spotted the account back in 2025, banned it and returned more than $100,000 to the players who had faced it. ClubWPT Gold acted on a single customer complaint, suspended the account while it investigated and reimbursed the player for losses from an affected session. Both responses predate the GGPoker measures against the malware by months.

Linking the accounts was the hard part for everybody else. The player at the centre of the case used different usernames on different platforms, so complaints landed in separate support queues and never added up to a pattern. Each operator saw a fragment, and the case that eventually pushed GGPoker into a malware crackdown grew in the gaps between them.

Online Poker’s Oldest Problem Comes Back

Nobody has been charged, and the identity behind the account remains unconfirmed. Investigators are still working, so every figure attached to the case, including that $4 million ceiling, belongs in the estimate column rather than the proven one. Suspicion alone has been enough to change how two major networks run their tables.

Poker has lived through this before. Absolute Poker and UltimateBet both collapsed into scandal when insiders gained access to opponents’ hole cards, and the damage to player trust lasted years. The difference now sits on the other side of the connection, because the GGPoker response to the malware campaign targets software players installed themselves, on their own machines, through updates they had no reason to question.

That shift leaves operators policing territory they have never controlled. Banning third-party tools solves part of it, and win-rate detection catches some of the rest, yet the home computer stays the weakest link in the chain. Until the industry treats those machines as part of its security perimeter, the next version of this story is only one compromised update away.