Jurojin's tampered poker update installed spyware on players' PCs (interview)

In October 2026, cybersecurity expert @wolfsec0x0 exposed a superuser scandal in online poker: attackers used compromised third-party poker tools to see victims’ cards, and pro Ignacio Moron believes he was cheated out of at least $100,000. Jurojin Poker, one of two compromised software products, told PokerNews it learned of the attack “the same way the community did” — through Wolf’s investigation and the suspicions of high-stakes players. It had long fought piracy, and said it had lumped the unusual activity into that problem rather than a targeted attack.

On Jurojin's side, the infections were passive: the tampered update infected the PC and installed the Mesh spyware on more machines than the attacker later actually used to snipe hands. The attack aimed mainly at high-stakes players, to a lesser extent at mid-stakes and much less at low-stakes. Jurojin says the attacker covered his tracks by moving users between version groups and pulling them out quickly, and that continuous backups of a database that size are not feasible — so its list of affected users may be incomplete.

In response, Jurojin removed the periodic saving of hands it had used to diagnose connection stability — leaving only manual saves — added internal security validations against similar supply-chain attacks, published a security notice, and notified users it could confirm were in the affected version groups. It recommends anyone who received an update in the period in question wipe and reinstall the PC, or at least run its Mesh-detection tool, and it has filed reports with international authorities.

One pro believes he lost at least $100,000; users told to wipe and reinstall PCs; Jurojin filed reports with international authorities.

Jurojin's update pipeline was compromised, so the attacker's software arrived as a trusted update from the company itself.

The company misread early signals as its known piracy problem instead of a targeted intrusion, and only learned the truth when the exposé landed.

A diagnostic feature that periodically saved hands stored playing-style data on customers' PCs, widening the exposure.

An attacker who can see hole cards in real time converts ordinary opponents into guaranteed losers at any stake level.

Unusual activity you can explain away as your known nuisance — here piracy — is how a targeted intrusion hides in plain sight.

Jurojin says Wolf deserves the credit for discovering and leading the investigation, with the company supporting it; detailed reports are ready for him and for casino security teams. It has suspicions about a few accounts beyond "Paul Gregg" but nothing solid enough to name, and says analyzing play data for cheating is the casinos' job since they see all hands. The reinstall advice stands for anyone who received an update in the affected window.