A new software has been released to detect superusers in online poker

After a major online poker cheating scandal, researchers have introduced open-source software to detect superusers and improve game security.

In light of the recent major scandal involving the use of “superuser” capabilities in online poker, the community has increased its demands for transparency and security. The problem was that malicious software embedded in modified poker clients allowed attackers to see other players’ screens and hole cards, leading to large-scale cheating among high-stakes professionals. In response to these events, the AceGuardian Research (A5 Labs) team has released its software suite for automatic superuser detection to the public, allowing operators and researchers to independently analyze their hand histories. Open-source AceGuardian Anti-Cheat: What It Is and How It Works Since 2019, AceGuardian researchers have been developing protection systems for online poker rooms, specializing in detecting collusion, bots, real-time assistance (RTA), and superusers. Their solutions are now implemented on seven poker platforms, where tens of millions of game decisions are analyzed daily. The new release is open-source code hosted on GitHub. It allows any poker platform operator or independent researcher to run automated checks for superuser indicators using existing hand histories. Additionally, AceGuardian accepts hand histories from operators and individual players for analysis with their models—just contact them at [email protected] . This tool emerged as a response to an incident in September 2025, when it was revealed that malware had been distributed through modified versions of popular poker helper apps—Jurojin Poker and IntuitiveTables. As a result of the attack, which lasted from June 2025 to June 2026, the perpetrator was able to substitute updates and install a trojan that allowed them to observe victims’ screens and cards. More than two dozen high-stakes players were affected, including on the GGPoker platform. After suspicious play was detected, several sites blocked accounts suspected of using superuser capabilities. Superuser Detection Methodology: How AceGuardian Analysis Works To detect superusers, AceGuardian uses a comprehensive analysis of played hands, with access to all players’ hole cards. Key metrics include: Equity Comparisons: Evaluates how much a player’s decisions depend on their equity against the actual opponent’s cards, assuming their equity against a standard opponent range remains unchanged. If decisions are clearly adjusted to the exact opponent’s cards, this is a red flag. Oracle Folds: Identifies situations where a player folds hands that would be ahead of a standard opponent range but behind the opponent’s actual hand. Such folds are nearly impossible without knowledge of the opponent’s cards. Bluff Index: Tracks the frequency and success of bluffs with low equity against specific opponent cards. Systematically successful bluffs against strong hands may indicate access to hidden information. Winrate Analysis: Compares the win rate in big blinds per 100 hands (bb/100) with the results of other players over similar sample sizes. An abnormally high win rate is an additional reason for scrutiny. Decision Timing Analysis: Examines not only the average decision time but also deviations from the player’s own “baseline.” Unnaturally fast or slow decisions in certain situations may indicate the use of external information. It’s important to note that none of these signals alone is proof of cheating. The system only issues a warning when several indicators coincide over a significant number of hands. Case example: after the September 29 incident, a review was conducted on one suspect’s hand history. Even the basic version of the AceGuardian algorithm flagged 72 hands in which the player made statistically impossible or super-optimal decisions against the opponent’s exact cards. Over 10 weeks, the suspect played 757 hands at the $25/50 limit, 95% of which were heads-up against the same opponent across 14 sessions. During this time, their winnings totaled about $45,000. Half the sessions lasted fewer than 30 hands, while in the others, the player won between $1,800 and $8,800 per session, except for one 250-hand session with a $15,300 win. Results Table Metric Suspect Opponent HU 25/50 Average Top 10 Winners Number of Hands 757 757 — — Number of Sessions 14 14 — — Average Win per Session ($) ~3,214 — — — Total Winnings ($) 45,000 — — — Winrate (bb/100) — — — — The table data allows you to compare the suspect’s results with the opponent, as well as with the average field and the top 10 winners at the 25/50 heads-up limit. Call to Action: What Operators and the Community Should Do The AceGuardian methodology and the entire software suite (in Python) are available on GitHub for free use by operators—you can independently run analysis on your own hand histories and identify suspicious cases. Additionally, AceGuardian offers other free services for the community, including the QuintAce platform—a new “play and learn” project—as well as tools for monitoring the poker industry’s ecosystem. Any operator or player can submit their hand history for analysis through AceGuardian’s models by contacting [email protected] . Who Is Behind AceGuardian and QuintAce The AceGuardian project and the QuintAce platform were founded by Dr. Thanh Tran, who previously taught computer science at the Karlsruhe Institute of Technology and was a visiting lecturer at Stanford University, as well as holding a leadership position at Upwork during its IPO. The head of Game Integrity at AceGuardian—John Andress—is known as a former high-stakes NL professional and one of the company’s co-founders since 2019. He leads the team developing methods for detecting unfair play. Among the key figures is also Will, who began his career at PokerNews as a freelance reporter in 2015 and has been on staff as managing editor since 2019. He graduated from the University of Kent in 2017 with a degree in German and holds an NCTJ diploma in sports journalism. What This Means for PPPoker Club Players For members of PPPoker clubs, this news has several important practical implications. First, the emergence of open tools for detecting superusers and other types of cheating increases overall trust in online poker. Now even small clubs can use AceGuardian’s developments to analyze their hand histories and quickly identify suspicious activity, without relying solely on the platform’s internal resources. Second, players can feel more confident about game integrity if clubs implement such control methods. This is especially relevant for those playing high stakes or participating in private games, where risks were previously higher due to limited verification options. Finally, if you have suspicions about specific hands or players, you can independently collect your hand history and contact AceGuardian for an independent review. This gives the community an additional tool for self-protection and maintaining fair play within PPPoker clubs.