A Canadian on-line poker participant is accused of accessing his opponents’ gap playing cards to cheat them out of a whole bunch of 1000’s of {dollars}.
A self-described cybersecurity skilled and poker fanatic, who goes by “WoflSecOxO” on X/Twitter, mentioned he confirmed somebody planted malware on poker gamers’ computer systems. The software program gave the consumer entry to his opponents’ screens and will see their gap playing cards.
⚠️ Online poker gamers: we’ve confirmed a covert remote-access agent planted on gamers’ Windows PCs by compromised poker software program.
Current estimate: ~30 customers affected, in a number of nations throughout Europe, North America and Oceania.
Details and checks beneath 🧵
— WolfSec0x0 (@wolfsec0x0) September 29, 2026
The preliminary tweet didn’t accuse or reveal the consumer. However, as extra individuals launched data concerning the state of affairs, Paul Gregg was named because the superuser.
According to WolfSecOxO, Gregg might watch his opponents’ display screen in real-time throughout real-money play, take management of the mouse and keyboard, run instructions with full system privileges, and replica recordsdata to and from the pc.
Given the particular dishonest, Gregg solely wanted to see his opponents’ display screen. Then, he might play completely towards them, making it just about not possible to lose cash.
Third-Party Software Confirms Cheating
Gregg acquired the malware on the victims’ laptop by compromising third-party software program. He used Jurojin Poker, and different on-line poker instruments, to get his malware on onerous drives.
Jurojin is an internet poker instrument that eases multi-tabling on-line poker. Players can set up tables extra simply, and make the most of different options like hotkeys to rapidly make bets at pre-determined sizes.
Earlier this week, Jurojin confirmed its software program was compromised and launched an announcement.
“This week, our investigation found that between June 2025 and June 2026, an attacker was able to intermittently replace the update package delivered to one specific group of Jurojin users with a tampered version. June 2026 was the last compromised month. Some of those packages included a remote-access tool,” Jurojin officers mentioned.
“This was a highly targeted operation, not a mass attack. It was carried out by a known cheater aiming at specific opponents, mostly at high stakes, with the goal of viewing their hole cards remotely. Jurojin was one of several applications targeted by the same actor, including IntuitiveTables. The same actor also operated phishing sites impersonating poker rooms and well-known poker tools.”
Jurojin builders mentioned they’re working with “Wolf” to additional safe their merchandise.
New Tactic, Same Cheating Method
The widespread phrase for dishonest by seeing opponents’ gap playing cards is named “superusing.” For apparent causes, it’s the simplest type of dishonest in comparison with different strategies like marking playing cards or colluding.
Unlike earlier superusing accusations, this is likely one of the most extremely expert methods of implementing the rip-off. In earlier superusing iterations, it required both an inside supply or entry to the participant’s precise laptop.
Russ Hamilton was the unique superuser. The 1994 World Series of Poker predominant occasion champion labored as a marketing consultant for Ultimate Bet. He used his position and entry to the positioning’s admin to see his opponents’ gap playing cards throughout high-stakes poker classes.
An analogous dishonest scandal occurred a number of years in a while Absolute Poker, the place a rogue worker underneath the display screen identify ‘Potripper’ cheated gamers utilizing the identical technique.
In 2013, Finnish poker professional Jens Kyllonen uncovered a dishonest rip-off at European Poker Tour stops. A bunch of scammers broke into resort rooms to achieve entry to gamers’ laptops. Then, they’d set up a trojan virus that gave them entry to their display screen.
More not too long ago, Mike Postle was accused to superusing on the Stones Poker Live stream. The prevailing concept was that match director Justin Kuraitis, who additionally ran the stream, gave Postle entry to the stream.
However, this was the primary time a participant used third celebration software program to infiltrate his opponents’ laptop. As a outcome, it’s a a lot harder rip-off to catch.
CoinPoker Was First To Catch Gregg
In the aftermath of the Gregg scandal, high-stakes common and CoinPoker ambassador Patrick Leonard revealed that his web site was the primary to do something concerning the accusation. In a sequence of tweets, Leonard mentioned the positioning realized one thing was improper and confiscated greater than $100,000 from Gregg’s account.
Then, they distributed the cash again to affected events. Gregg additionally performed on a wide range of different websites and networks, together with ACR and GGPoker, however neither of these websites took motion but.
Things are leaking so right here goes. Deleted all ambiguous posts from the previous couple of days and can do a abstract right here
– similar participant has performed throughout mainly all of the websites
– coin caught him round 1 yr in the past after he had performed lower than every week on the positioning. ofc we didn’t know precisely what he was doing, nevertheless it was apparent he had extra data than different gamers. We didn’t know he hacked Jurojin/intuitive tables, I’ve used Jurojin each single poker session since, if we knew that I wouldn’t have accomplished that!!
– he made a case with regulators and many others, in fact we absolutely obliged as a result of we’re assured in our safety workforce and our case.
– this course of lasted a short time then we refunded all our gamers who had been affected
He continued enjoying on the identical websites that he was enjoying on earlier than. A bunch of round 100 regs got here collectively and informed these websites beginning a pair years in the past what they suspected with superb particulars. He in some way was allowed to proceed enjoying on these websites, successful and withdrawing at win charges that had been possible not potential and showdowns that didn’t make sense.
The way forward for on-line poker is within the arms of the websites and the way a lot they’re prepared to research and act on bots & standalone characters like this.
— Patrick Leonard 🫡 (@padspoker) October 2, 2026
