Wired: hacker may have watched online poker players’ hole cards for more than a year and won up to $4 million

Wired has outlined a cheating scheme that used infected poker software to expose players’ screens, including their cards, through remote access tools. For PSPs, this is a reminder that payment fraud and platform compromise are often the same story once the money starts moving.

1. According to Wired, the attacker embedded malicious code into Jurojin and IntuitiveTables, two popular tools used by online poker players to manage multiple tables at once. Players downloaded infected versions from official sources, which is the kind of detail operators tend to hate: the distribution channel looked normal.
2. The software checked a user’s nickname against a list of potential targets and, on a match, silently installed a remote access tool that showed the player’s screen and hole cards. The attacker then joined the same table and played against the victim with that information in hand. Cybersecurity specialist WolfSec estimated that more than 1,000 users may have been exposed.
3. The scheme came to light with the help of AI. In September, a professional poker player Wired calls Alex used Claude to analyze his statistics, and the assistant flagged a suspicious program on his computer. The software had been installed in April and had taken screenshots at least 11 times. In 10 of those cases, Alex was playing the same opponent under the nickname OxOO on ACR Poker. He estimated his losses at about $30,000.
4. Spanish poker player Manuel Saavedra, who plays as J0hn Mcclean, said the infected software had been on his computer for more than a year. After reviewing part of his hands on GGPoker and ACR Poker, he said the confirmed losses may be only a small part of the real damage.
5. The suspicious player was already on operators’ radar in 2025. CoinPoker blocked the account and returned more than $100,000 to affected players, and later ClubWPT Gold also blocked the account and compensated one player. The game, however, kept going on other platforms, including GGPoker and ACR Poker. After the story became public, ACR released ScreenShield, a feature designed to hide poker tables from screen-capture software.

For high-risk operators and their payment partners, the useful bit here is not the poker drama. It is the chain: trusted software distribution, hidden screen capture, account abuse across multiple venues, and loss attribution that only becomes clear after the fact. Once a scheme like this runs for months, the settlement and chargeback exposure can be the easy part to measure.