Cyberattack on Jurojin Poker: Developers’ Statement and Consequences

In June 2026, the third-party software Jurojin Poker suffered a cyberattack. The developers shared details of the incident and the measures taken to protect users.

In June 2026, the online poker world was rocked by a major scandal involving the use of malicious software to gain an unfair edge at the tables. This time, the third-party program Jurojin Poker—a popular tool among advanced players for optimizing play across multiple tables—came under fire. The development company released a detailed statement outlining the specifics of the attack, the affected users, and the steps taken to bolster security. What is Jurojin Poker and how did the attack happen? Jurojin Poker is specialized software designed for players seeking to maximize their efficiency in online poker. The program offers table management features, customizable hotkeys, bet sizing tools, and overlays useful information onto the poker client. This all-in-one approach allows players to make decisions faster, better organize their sessions, and play more effectively on several tables at once. In June 2026, it emerged that around 30 players—primarily high-stakes regulars—had fallen victim to a targeted cyberattack. Jurojin representatives stated that they reached out to each affected user directly via email. The attack was not widespread; instead, the perpetrator focused on a select group of opponents in order to gain access to their screens and view their hole cards in real time. According to the company’s official statement, from June 2025 to June 2026, the attacker periodically swapped out updates for a specific group of Jurojin users with malicious versions. Some of these updates contained a remote access tool, allowing the attacker to see everything happening on the victim’s screen. The attack was meticulously planned and carried out manually—this was not a mass infection, but a precise operation targeting chosen players. Jurojin was not the only software product targeted by this attacker. Other affected applications included IntuitiveTables. Additionally, the same individual created phishing sites mimicking poker rooms and well-known poker tools in an attempt to trick players into giving up their data. How did Jurojin respond to the incident? The Jurojin Poker development team provided a detailed account of their response to the discovered threat. According to them, even before the compromise became public, the team had already begun strengthening security measures. In particular, they implemented a policy of regularly rotating the encryption keys used for the app’s communication with their servers. This proactive step significantly complicated the attacker’s efforts and limited their ability to distribute further malicious updates. After detecting the attack, the Jurojin team took additional actions: Restricted access to sensitive server settings; Introduced mandatory multi-factor authentication for any operations involving editing or deleting server data; Began keeping detailed logs of all update downloads from company servers; Collected and preserved logs of all compromised versions and their distribution dates for law enforcement and security experts. Jurojin is also working with cybersecurity expert Wolf (also known as @wolfsec0x0), who was the first to publicly report the attack and assisted in the investigation. The company emphasizes that the attack was extremely selective: the perpetrator manually replaced updates only for specific users, most of whom were high-stakes professionals. There was no mass infection, and every case was carefully documented. Jurojin has prepared detailed reports for stakeholders and has already handed over some materials to the relevant authorities. In closing their statement, the company apologized to those affected and assured all users that security will remain their top priority. “In the future, we will be better prepared,” Jurojin representatives stated. Attack details: how the attacker gained access to players’ cards The essence of the attack was that, for a specific group of Jurojin Poker users, program updates did not come from the official server but were swapped out for malicious versions. These versions included a remote access tool, allowing the attacker to view the victim’s screen in real time. In this way, the attacker obtained information about players’ hole cards—one of the most valuable assets in poker, especially at high stakes. Jurojin stresses that all of the attacker’s actions were manual—there was no automation or mass distribution of malicious updates. The attack was targeted at specific players, as confirmed by the analysis of update logs and historical software versions. The company was able to precisely identify which versions were compromised and when they were distributed. In addition to Jurojin, other third-party applications used by poker players to boost efficiency were also targeted. The attacker also created phishing sites mimicking the interfaces of well-known poker rooms and tools to trick players into revealing their data. Community reaction and industry consequences The exposure of this scheme sent shockwaves through the poker community. Professional players, especially at high stakes, found themselves at risk, as the leak of hole card information can lead to significant financial losses and undermine trust in online platforms. Jurojin promptly contacted all affected users, providing them with detailed information about the incident and recommendations for next steps. The company is also actively working with cybersecurity experts and law enforcement to minimize the consequences of the attack and prevent similar incidents in the future. This case once again highlights the importance of security when it comes to third-party poker software and the need to be vigilant about updates and only download software from official sources. Who was affected: scale and specifics of the attack According to Jurojin, about 30 users were affected—all of them played at high stakes and were of particular interest to the attacker. There was no mass infection; the attack was extremely targeted and selective. The company contacted each affected user individually to inform them of the incident and offer support. Jurojin also noted that the malicious updates were distributed only during a limited period—from June 2025 to June 2026. After that, thanks to stricter security measures and key rotation, the attacker lost the ability to replace updates and distribute malicious software. Among other programs that were also attacked was IntuitiveTables. This indicates that the perpetrator was well-versed in the third-party poker software market and deliberately chose tools used by professionals. What security measures has Jurojin implemented after the attack? Following the incident, the Jurojin team significantly strengthened their security system. The following measures were implemented: Rotation of encryption keys to prevent unauthorized access; Restriction of access rights to critical server settings; Multi-factor authentication for all operations involving changes or deletion of data; Detailed logging of all software downloads and updates; Collection and storage of the complete software version history for subsequent analysis and transfer to the relevant authorities. These steps are aimed at eliminating the possibility of similar attacks in the future and ensuring maximum protection of user data. What this means for PPPoker club players This incident serves as an important reminder for all PPPoker club members about the need for heightened attention to security. Even if you don’t use third-party tools to optimize your game, there’s always a risk of encountering malware or phishing schemes—especially if you play for significant amounts. Key takeaways for our readers: Download and update any poker software only from official websites and trusted sources. Don’t click on suspicious links, even if they look like the sites of well-known rooms or tools. Use strong passwords and, whenever possible, enable two-factor authentication for all poker-related services. Regularly scan your devices for malware and stay up to date on potential threats in the poker community. For PPPoker clubs, this case is a reason to once again review internal security procedures, and for players—a reminder of the importance of cyber hygiene. The higher your stakes and the more attention you attract, the greater the chance of becoming a target for such attacks. Stay vigilant and protect your game!