Poker Players Face New Risks After Jurojin Update Attack

By Marcus Chen · Senior Poker Editor

October 1, 2026· 3 min read

Jurojin has confirmed that an attacker intermittently replaced software updates sent to a specific group of its users between June 2025 and June 2026. Some tampered packages included a remote-access tool, and June 2026 was the last month in which Jurojin says a compromised package was delivered.

The admission turns a developing online poker security story into a confirmed compromise of a third-party tool. The reported aim was to view targeted players’ hole cards remotely, making the incident a game-integrity concern as well as a warning about the software running alongside poker clients.

Two third-party tools were targeted

Jurojin’s statement described a highly targeted operation against specific opponents, mostly high-stakes players, rather than a mass attack. The same actor targeted IntuitiveTables, another table-management product, and operated phishing sites impersonating poker rooms and well-known poker tools.

Both programs help players manage tables across multiple sites, including opening and closing tables, adjusting their size and using hotkeys. That functionality is part of a wider third-party poker software ecosystem that runs alongside the poker clients themselves, making the security of these tools relevant to both account safety and fair play.

PokerHack · Poker Analytics SuiteSponsored

Find the leak that's costing you the most money.

Paste a hand history and PokerHack ranks your worst mistakes by $EV lost, then shows the exact GTO fix for each one.

Find my biggest leakFree to start · no card required · Analysis in under 60 seconds

The distinction between the tools and poker operators matters. PokerStrategy’s account of the incident says online poker operators themselves had not been compromised in these attacks; the confirmed route described by Jurojin was the altered update package delivered to a selected group of its users.

Remote access raised the hole-card risk

Jurojin said some of the tampered packages contained remote-access software. If an attacker could use that access to view a targeted player’s screen during a hand, the result could resemble a superuser advantage at the table: knowledge of an opponent’s hole cards without the opponent’s awareness.

The company described the targeting as selective and carried out by hand. Its statement also connected the same actor to phishing sites masquerading as poker rooms and established poker tools, broadening the reported threat beyond the update mechanism alone. The episode sits alongside other poker-related account-security concerns, though phishing and a compromised software update are distinct attack routes.

According to the primary report, Jurojin emailed directly affected customers with an apology. The report also said GGPoker contacted customers after finding MeshCentral on computers during a routine inspection. That does not establish that GGPoker’s poker software or systems were compromised; it describes the operator’s response to software found on players’ computers.

Questions remain for players and tool providers

Jurojin said it provided affected customers with guidance and outlined planned security measures, but the available account does not include the full customer checklist or the technical commitments in detail. It also does not identify alleged winning accounts or name the person behind the operation, so those claims should not be treated as established by this confirmation.