Poker Sites Warned About “Paul Gregg” Before Online Cheating Scandal Broke Open

The online poker security story around the suspected “Paul Gregg” account has moved from a single cheating allegation to a broader question: who knew what, and when. Reports now say poker operators were warned about the account before the wider investigation became public, which matters because this is the kind of incident that can turn a software trust issue into a payments and fraud problem fast.

1. The alleged operation used malware embedded in updates to third-party poker software, according to the reports. Jurojin Poker confirmed its software was one of the affected products, and said attackers were able to push altered updates to some users between June 2025 and January 2026.
2. Another poker management tool, IntuitiveTables, was also said to have been compromised. These tools are used to play multiple tables and automate some functions during online play, which is exactly why access to them is so sensitive: once a machine is compromised, the attacker is not just watching the player, but potentially seeing live cards and controlling the device.
3. The malware reportedly used MeshCentral, a legitimate remote-access system, to gain control. Once installed, it could allow an attacker to see a player’s screen and control the computer. Cybersecurity researcher WolfSec0x0 said the incident may have affected 10 to 30 computers across several regions, and the attack appeared highly selective rather than aimed at poker players generally.
4. Jurojin said the suspected attacker seemed to be targeting particular high-stakes players and had previously hit poker-related services. That lines up with the economic logic here: this was not a broad, noisy attack, but a focused attempt to extract value from a small set of high-volume tables.
5. The “Paul Gregg” account itself had already drawn concern before the scandal surfaced. Poker coach Patrick Howard sent an analysis to GGPoker in September flagging unusual patterns and asking the operator to check the activity; later, GGPoker confirmed it had been in contact with Howard about its investigation. CoinPoker also reportedly flagged suspicious activity, deleted the account, and seized more than $100,000 before reimbursing players who had taken part. CoinPoker ambassador Patrick Leonard said the account had been on the platform for less than a week before it was noticed.

The part operators should care about is not just the cheating angle. When malware rides in through third-party software updates and remote-access tooling, the attack surface extends beyond the poker client itself into device security, player monitoring, and payment-linked account integrity. Spanish professional Ignacio Morón said he lost between $100,000 and $200,000 to the alleged account, including roughly $60,000 in a single 15-minute period, which gives you a sense of how quickly these incidents can translate into outsized losses.

Security responses are already tightening elsewhere in the sector. ACR Poker has rolled out a feature that blocks screen-sharing and screen-capture software from running alongside its client.