The Poker Superuser Malware 2026 scandal is a fresh blow to online poker. Hackers gained a way to see rival hole cards. Crypto poker site CoinPoker has now banned a suspect account. Several other rooms also took action.
Poker Superuser Malware 2026: How The Attack Worked
The attack did not target the poker rooms directly. Instead, it hit third-party tools that many players use. Two names stand out. They are Jurojin Poker and IntuitiveTables.
Attackers slipped malware into software updates for those tools. The malware was a remote-access program called MeshCentral. It let the attackers view screens and control computers. As a result, they could watch hole cards in real time.
The campaign ran from June 2025 to January 2026. Between 10 and 30 computers fell victim. Victims lived in Europe, North America, and Oceania. Jurojin called it “a highly targeted operation, not a mass attack.”
A cybersecurity researcher known as WolfSec0x0 exposed the scheme. Meanwhile, suspect accounts across several rooms carried the name Paul Gregg.
Why It Matters For Players
CoinPoker banned the suspect account. It also seized more than $100,000 from it. Furthermore, the site issued refunds to affected players. CoinPoker ambassador Patrick Leonard reported the bans.
GGPoker looked into a suspicious account too. Poker coach Patrick Howard first flagged odd results to that room. One player, Ignacio Moron, says he lost between $100,000 and $200,000.
ACR Poker took a different route. It launched a tool called Screen Shield. The tool blocks screen-capture programs during play.
Crypto poker carries a special risk here. Blockchain payments are hard to reverse. Therefore, quick refunds depend on the goodwill of the site. Players should favor rooms with clear security teams and a record of paying victims back.
Casino Bonus Streak Perspective
We like crypto gaming for its speed. However, speed means little if your device leaks data. Every add-on you install is a door into your computer. Keep tracking tools updated, but watch for odd behavior after each update.
Additionally, choose operators that react fast to cheating reports. CoinPoker moved quickly here. That kind of response builds trust. Compare welcome deals on our list of best casino bonuses. Then check our guide to fast payout casinos if quick cash-outs matter most to you.
Also, think about how you store your crypto. Keep only your session bankroll on a poker site. Move bigger sums to a wallet you control.
What Players Should Watch Next
More rooms may publish their own reviews of the Poker Superuser Malware 2026 case. Additionally, the tool makers must explain how attackers reached their update servers. Players should run a malware scan if they used Jurojin or IntuitiveTables in that window.
Meanwhile, watch for new anti-cheat tools like Screen Shield. Other rooms may copy that idea soon. In contrast, rooms that stay silent deserve extra caution. (Source: Casino.org)
