Jurojin Poker, one of two software tools at the center of the online poker superuser scandal, has apologized to affected players and explained how a tampered update let an attacker spy on high-stakes players' screens. The company's answers to PokerNews on October 9 are the most detailed account yet of how the attack worked, who was exposed, and what users should do now. If you play online poker with any third-party software installed, this is worth reading carefully.
What Happened
The scandal was exposed in late September by cybersecurity researcher @wolfsec0x0, known as Wolf, who showed that attackers used third-party software to view an online player's screen. According to PokerNews, high-stakes player Ignacio Moron believes he was cheated out of at least $100,000. Jurojin issued an initial statement on October 1, and a separate PokerNews report on October 3 said poker sites had been warned about a suspicious account.
Jurojin says it learned of the attack the same way the public did: through Wolf's investigation and concerns raised by high-stakes players. The company had been fighting crackers who sold pirated copies of its software, and it says some of the unusual activity was mistakenly grouped with that problem. It assumed the activity was not a targeted attack.
How the Attack Worked
Jurojin describes the attack as highly targeted, mainly against high-stakes players, to a lesser extent mid-stakes, and much less so low-stakes. The infection was passive: a tampered update infected PCs and installed spyware called Mesh on more machines than the attacker actually used to exploit players.
This is what security professionals call a supply-chain attack. Instead of tricking each victim individually, the attacker compromised a trusted update channel, so users who installed a legitimate-looking update received malicious code. The attacker then selected which infected machines were worth exploiting. Jurojin says the attacker moved players between software version groups and removed them quickly, which makes it harder to identify everyone affected. The company has a list of users confirmed to be in affected version groups at specific dates and times and is notifying them directly, but it says the list may be incomplete because continuous backups of the database were not feasible.
Low-stakes players are not off the hook. Jurojin says it has no evidence they were targeted for "sniping," meaning having their cards viewed, but they could still have been infected with Mesh.
What Jurojin Is Doing
According to the interview, Jurojin has taken several steps:
- It removed periodic hand saving, which had been used to diagnose connection stability. Hands are now saved only when a user manually sends a report, reducing the playing-style data stored on users' PCs.
- It added internal security validations to guard against similar supply-chain attacks.
- It filed reports with international authorities in jurisdictions where it believes the attacker operated.
- It has detailed reports ready for Wolf and casino security teams.
Jurojin credits Wolf with the discovery, saying he "deserves all of the credit." It also says that security measures it had been adding over previous months kept the attacker out of further systems and that the incident gave it better tools to investigate and make future attacks harder. The company says that although the attack was a blow to its pride, it shows the new security measures worked.
Compensation and Responsibility
One notable absence: the article does not describe any compensation program from Jurojin. The company says it would like affected users to recover their funds and believes the casinos have a major responsibility to make that happen. Jurojin does not analyze game data, so it cannot flag players by playing style, and it says that responsibility lies with the casinos, which can see all hand histories. The company had suspicions about a few accounts but nothing it could confirm.
This is the key unresolved question. Players who believe they lost money to a compromised opponent will have to look to the poker sites, not the software maker, for refunds. It is another reason to choose rooms with a strong security record and transparent dispute processes. Our safe poker sites guide explains what to look for.
Is Online Poker Dying?
Jurojin pushed back on some of the coverage, arguing that online poker is not dying and that reports calling this the biggest story in online poker history are sensationalized. It points to ongoing player volume across tournaments and cash games as evidence. That is a self-interested argument from a company in the middle of the scandal, but it is fair to note that the scandal so far has centered on specific software and a limited group of players, not on the poker networks themselves.
Still, trust is the currency of online poker. A single high-profile cheating case can shake confidence far beyond the players involved. For a broader look at how networks differ in security and oversight, see our poker networks guide.
What Players Should Do Now
Jurojin's recommendations are practical, and they apply even if you never used its software.
1. Wipe and reinstall if you were exposed. Jurojin's general recommendation is to wipe and reinstall the PC from scratch. It notes that a clean reinstall is good security practice twice a year anyway. If that is too disruptive, run Jurojin's tool to check whether Mesh is still installed.
2. Follow the published steps. Users who received an update from Jurojin during the affected period should follow the steps in its security notice.
3. Reduce your software footprint. Every overlay, tracker, HUD or utility you install is another potential supply-chain risk. Use only tools you need, from developers you trust, and check whether the poker room you play on permits them. Some sites ban such tools outright.
4. Use separate devices or accounts where you can. If you play high stakes, consider a dedicated machine for poker, kept clean of unrelated software. At a minimum, keep your operating system updated and use strong, unique passwords with two-factor authentication.
5. Watch your results. If you see unusual patterns, such as opponents who seem to know your hand, save hand histories and contact support. Document everything. Sites can only investigate what they know about.
6. Choose rooms with strong security. Look for operators that publish security practices, respond to complaints, and support secure payment methods. If you prefer crypto, review our crypto poker guide for the trade-offs.
What This Means for Different Players
High-stakes players are the main targets and should treat this as a serious security event. Mid-stakes and low-stakes players are less likely to have been sniped, but may have been infected. Recreational players who never used third-party software are at lower risk from this specific incident, though general hygiene always applies.
If you are shopping for a new room, our real money poker page and reviews such as Americas Cardroom cover licensing, software and support, which are exactly the factors that matter after a scandal like this.
Bottom Line
Jurojin's apology and technical explanation fill in much of the picture: a tampered update, spyware installed on more machines than were exploited, a targeted focus on high-stakes players, and a list of affected users that may be incomplete. What remains unsettled is who compensates victims. Until that is answered, the practical response for players is to clean their machines, trim their software, and pick poker rooms that take security as seriously as they take rake.