Malware scheme tied to poker software may have cost players $4m
An investigation has linked compromised multi-tabling software to a remote-access cheating scheme on online poker sites, with Americas Cardroom's response drawing scepticism from affected players.
High-stakes online poker players may have lost up to $4 million to an attacker who gained hidden access to opponents' hole cards, according to an investigation reported by Casino.org News.
The scheme allegedly relied on compromised versions of Jurojin and IntuitiveTables, two tools widely used by professionals who run several tables at once. Those programs are said to have been used to install MeshAgent, remote-access software capable of viewing and controlling an infected player's computer without any breach of the poker operators' own systems.
Reporting by WIRED suggests the tainted software may have spread to more than 1,000 users, though its covert monitoring functions appear to have been switched on only against select high-stakes targets.
One professional player, referred to by WIRED under the pseudonym Alex, said he began investigating after an AI assistant flagged the presence of MeshAgent on his system in September. He identified 11 occasions that looked like screen-monitoring activity while playing on Americas Cardroom (ACR), with the same opponent present for 10 of them. That opponent's unusually strong results had already drawn suspicion. Alex puts his own losses at roughly $30,000.
ACR's operator, Winning Poker Network, told WIRED that its integrity staff reviewed in excess of two million hands from accounts on which MeshAgent had been detected, including around 200,000 hands tied to the account named in the complaints. The operator said that review turned up no proof that any player had used knowledge of rivals' hole cards to gain an edge.
ACR has told customers it will not refund losses, though it shut down the suspect account after weighing information supplied by other operators. Players including Alex remain unconvinced, pointing to his monitoring logs and the opponent's outsized win-rate as grounds for continued doubt.
Other platforms moved differently. CoinPoker said it passed its own findings on the suspected cheater to ACR but received no reply; it had already closed an account it believed was linked to the scheme and had refunded players more than $100,000. ClubWPT Gold likewise banned an account and compensated a customer who had been affected.
Poker coach Patrick Howard said he had alerted GGPoker to suspicious results before the malware scheme came to light publicly in September. Since then, GGPoker has introduced new detection measures to catch abnormally high win-rates and has prohibited players from using outside poker software. The operator says it has traced funds it believes are proceeds of the scheme to a cryptocurrency wallet, asked Coinbase to lock down the account holding them and keep its records intact, and passed its findings on to law enforcement.
ACR is set to switch on its ScreenShield feature by default from November 4, a protection designed to stop supported screen-capture and remote-viewing tools from displaying a player's cards to anyone else.