Malware Scandal in Poker Software: Details of the High Roller Attack

In June 2024, hackers breached the Jurojin Poker software, gaining access to players' screens and causing significant losses. Here are the details of the incident and the community's response.

In early June 2024, the poker community was shaken by news of a large-scale attack on high-stakes players using malware embedded in the popular poker software Jurojin Poker. As a result of the breach, attackers gained the ability to view victims’ screens during play, leading to significant financial losses. One of the victims, well-known high roller Ignacio Moron, stated that he lost at least $100,000. In this article, we will detail the incident, Jurojin Poker’s response, the security measures taken, and what lessons PPPoker club players can learn from this story. How the Attack Happened: Timeline and Methods Used by the Attackers The scandal erupted after an investigation was published by cybersecurity specialist @wolfsec0x0 . He discovered that a group of high-stakes players had been targeted with a so-called "superuser" exploit. The essence of the attack was the use of third-party malware that allowed attackers to see players’ screens in real time. This gave them an undeniable advantage — the ability to see opponents’ cards and make optimal decisions. Jurojin Poker was one of two software products compromised in this attack. As Jurojin Poker representatives explained, they learned about the incident at the same time as the rest of the community, when Wolf’s investigation and high rollers’ suspicions were published. Before this, the Jurojin team had been fighting the spread of pirated copies of their software, sold at reduced prices, and some suspicious activity was mistakenly attributed to this problem rather than a targeted attack on users. The malware was distributed through a fake Jurojin Poker update. After installing the infected version, a spyware module called Mesh was installed on the user’s computer, giving attackers access to the player’s screen. It’s important to note that there were more infected machines than those actually used for attacks: the attacker carefully covered their tracks, moving users between groups and quickly removing them from control. Who Was Affected: Scale of the Attack and Player Categories According to Jurojin Poker, the main target of the attack was high-stakes players ( high-stakes ), to a lesser extent mid-stakes ( mid-stakes ), and only minimally low-stakes ( low-stakes ) players. On Jurojin’s side, infection occurred passively: the malicious update infected PCs, but the attacker only used access to a portion of the victims. Jurojin Poker has a list of users who were very likely affected on certain dates and times. These players are receiving personal notifications. However, the company emphasizes that the list may be incomplete: due to the attacker’s actions and the inability to make continuous backups of a huge database, some victims may have gone undetected. For low-stakes players, the risks are minimal: there is no evidence that they were specifically "sniped" (had their cards peeked at for an advantage). However, infection with malware is still possible, so all users who updated Jurojin Poker during the specified period are advised to take precautions. Recommendations for Users Full system reinstall. Jurojin Poker recommends performing a clean reinstall of Windows to guarantee removal of the spyware. This is labor-intensive but the most reliable measure. Use of a diagnostic tool. For those not ready to reinstall, the company offers a special tool to check for Mesh on your computer. Jurojin notes that regular clean system installs are good practice for security, even outside of such incidents. Jurojin Poker’s Response and the Course of the Investigation After the attack was discovered, Jurojin Poker actively cooperated with Wolf, who first uncovered the breach and is leading the investigation. The company provided him and casino security services with detailed reports and implemented a number of code changes to prevent similar attacks in the future. Measures taken include: Automatic saving of hand histories for connection diagnostics has been disabled to minimize the amount of gameplay data stored on PCs. Now, history is saved only manually at the user’s request. New internal security checks have been implemented to protect the supply chain and prevent malicious code from being introduced during updates. Official reports have been filed with international law enforcement agencies in jurisdictions where, according to the company, the attacker operated. Jurojin emphasizes that all credit for discovering the attack belongs to Wolf: he identified and investigated the incident, while the Jurojin team supported the investigation by providing additional data and reports. The company also admitted that previously, some attacks were mistakenly attributed to distributors of pirated Jurojin copies, with whom a separate battle was being fought. This made it harder to promptly identify the true nature of the threat. Possible Suspects and Community Reaction When asked about other suspicious accounts besides the well-known "Paul Gregg," Jurojin representatives replied that they had suspicions about several users but lacked sufficient evidence for public accusations. Furthermore, Jurojin does not analyze gameplay data or playing style — this is handled exclusively by poker rooms and casinos, which have full information about the hands played. The company emphasizes that the fight against pirated Jurojin copies and related threats has been ongoing for a long time, and some of the attacker’s actions were mistakenly attributed to this category. Jurojin Poker’s Position and the Scandal’s Impact on the Industry Jurojin Poker officially states that it takes the incident extremely seriously and understands players’ concerns. At the same time, company representatives urge people not to panic or sensationalize. In their view, despite loud claims of the "end of online poker," the industry remains resilient: numerous tournaments, cash games, and spins are held daily, and interest in online play continues to grow, especially after the COVID-19 pandemic. The company expresses regret to all victims and states that it supports the idea of reimbursing those affected, placing the main responsibility for this on poker rooms and casinos. Jurojin emphasizes that it is constantly improving its security systems, consulting with experts, and closely monitoring new threats. According to company representatives, the incident was a blow to their pride, but it also demonstrated the effectiveness of the security measures already in place: the attacker was unable to access new versions of the software, and the Jurojin team now has tools for more thorough analysis of similar incidents in the future. “We deeply regret what happened. Security has always been and remains our priority. We constantly learn from the best specialists and implement new protective measures. This incident has been a lesson for us and a motivation to make such attacks as difficult as possible in the future.” — Jurojin Poker notes. For players concerned about security, the company advises paying attention to activity in poker rooms: despite the incident, player pools remain large and games run around the clock. Prize and Victim Table As part of the investigation, the names of victims were revealed, most notably Ignacio Moron, who reported losing at least $100,000. Other names and amounts have not been disclosed, as the investigation is ongoing and some victims may remain unidentified due to the nature of the attack and the impossibility of a full data audit. Player Status Estimated Losses Ignacio Moron Victim (high-stakes) $100,000+ Brief FAQ: What to Do If You Used Jurojin Poker I played low stakes. Could I have been "sniped"? According to Jurojin, the attack targeted high rollers. For low-stakes players, the risk is minimal, but Mesh infection is possible. How do I know if my PC is infected? If you installed Jurojin Poker updates during the specified period, use the official tool to check or perform a clean system reinstall. What is the company doing to prevent new attacks? Jurojin has implemented new security measures, disabled automatic hand history saving, strengthened internal checks, and is cooperating with international authorities. Will stolen funds be returned? Jurojin supports the idea of reimbursement but believes responsibility lies with poker rooms and casinos. What This Means for PPPoker Club Players For PPPoker club members, this story is an important reminder of the need to pay close attention to cybersecurity. Even if you play low stakes and are not among the targeted victims of such attacks, infection with malware can lead to personal data leaks, account compromise, and financial losses. Practical takeaways for PPPoker players: Use only official versions of poker clients and auxiliary programs. Do not download software from suspicious sources or install pirated copies — this is the main channel for malware distribution. Regularly update your antivirus and monitor your system’s security. Run preventive checks and do not neglect recommendations to reinstall your system, especially after suspicious incidents. Be alert to unusual activity on your account. If you notice strange actions or suspect a compromise, immediately contact your club’s support service and take steps to secure your account. This incident showed that even large and reputable software can become the target of targeted attacks. Therefore, every player should not only rely on the platform’s security measures but also take care of protecting their own data and funds. Keep your software up to date, use only trusted programs, and do not ignore warning signs of possible threats — this will help keep your money safe and your enjoyment of the game intact.