ACR Poker CEO Phil Nagy has issued a statement after high-stakes poker players were targeted with software capable of exposing their hole cards in real time.
In a seven-minute video posted on X, Nagy addressed the cheating allegations and outlined what ACR Poker is doing in response.
Nagy also unveiled a new security measure called Screen Shield, which prevents WPN tables from being visible to screen-capture and screen-sharing tools like those allegedly used in the attacks.
No poker clients are believed to have been compromised. Instead, malicious versions of third-party poker software were allegedly used to install remote-access software on players’ PCs.
Players on ACR Poker, GGPoker and CoinPoker have reported being affected by accounts linked to a player named Paul Gregg.
According to CoinPoker ambassador Patrick Leonard, CoinPoker banned an account named ‘Europe’, issued refunds to affected players, and confirmed the account was registered in Paul Gregg's name.
ACR Poker, meanwhile, said it has sent hand histories from affected players to GTO Wizard for analysis and confirmed that a wider investigation is underway, which could lead to compensation.
ACR Poker launches Screen Shield
Nagy said WPN contacted players on Tuesday, September 29, whose computers were identified as running remote-access, screen-sharing or screen-control software, and activated Screen Shield for them.
In the video, Nagy demonstrated the Screen Shield feature and said WPN would allow players to activate it themselves in a future update.
That followed the publication of WolfSec0x0's investigation into the attacks.
Nagy went on to say WPN will regularly scan the network and, when screen-sharing software is identified, ask players whether they want Screen Shield activated.
There are legitimate uses for remote-access and screen-capture software. When Screen Shield is on, players won’t be able to take screenshots of wins or stream on sites like Twitch/Kick.
Nagy also offered Screen Shield technology to other operators.
What new details have emerged in the poker cheating scandal?
More information has emerged since cybersecurity expert WolfSec0x0 published details of the attacks on Tuesday, September 29.
A thread on the 2+2 poker forum added further information, including the names of accounts linked by players to the alleged cheating operation.
- GGPoker: Paul Gregg
- CoinPoker: Europe
- WPN: JackKlompus
- WPN: OxOO
- WPN: Ez[Pz]
The 2+2 thread, titled ‘Scary News’, opens with a Telegram post from high-stakes player Aleksey Borovkov.
He says, “A cheater (most likely a group of cheaters) somehow managed to install their spyware on the computers of multiple different regs and gained access to their screens…
“His results were so insanely good that people started looking into them and noticed a pattern: all the money he won came from a specific group of regs, and 90%+ of his hands were played at tables with those exact players. In other words, he was deliberately table-selecting them. From there, they eventually discovered the trojan itself.”
Compromised software identified
Since then, the two compromised third-party poker tools have been identified as Jurojin Poker and IntuitiveTables. Players who have used either tool are being urged to check their PCs.
Jurojin Poker has issued a comprehensive statement and provided a tool that allows users to check whether their PCs have been compromised. It also says the infection ended in January 2026.
IntuitiveTables sent out a communication to its users, which we’ve embedded below.
IntuitiveTables sent out a statement to users.Leonard has also provided more detail on CoinPoker's previous ban of ‘Europe’ – an account connected to Paul Gregg – and said the operator confiscated more than $100,000.
In a Telegram message from Leonard, the CoinPoker ambassador states, “Our security team found somebody doing X. They banned him, confiscated $100K+… He made a big deal out of it, reported them to the gaming commission to claim $ back and protest innocence. We had no problem with that and built our case with full evidence, and agreed to go to court/do the case etc., but he didn’t continue his pursuit. The name on the account was... Paul Gregg.”
In a post on X, Leonard claimed the same person had been playing across different sites but was banned by CoinPoker a year ago, with refunds issued to affected players.
Leonard said he didn’t know details about the compromised software back then and admitted that he carried on using Jurojin after ‘Europe’ was banned.
“He continued playing on the same sites that he was playing on before,” Leonard added. “A group of around 100 regs came together and told those sites starting a couple years ago what they suspected with very good details. He somehow was allowed to continue playing on those sites, winning and withdrawing at win rates that were likely not possible and showdowns that didn’t make sense.”
PokerOrg has approached GGPoker and ACR Poker about the accounts named above.
Affected players react
Players affected by the compromise have also been posting on X, including Manuel Saavedra, who plays online under the name J0hn Mcclean.
Saavedra claimed that he had used the compromised software and was directly cheated against, writing, “During that time, they were watching my cards and playing against me with that information, taking money directly from me.”
He attached details of losses he said he had been able to verify and also posted an image showing the MeshAgent software on his PC.
Leonard quote-tweeted saying, “It must feel so bad losing every day for so long, questioning yourself, when it’s your job it’s your identity. Prepare well for the session, study hard, come back every day and get whacked and nothing was in your control. Mentally that is just so fucked.”
Run It Once coach Frankie Carson posted the win rates from the two WPN accounts and asked, “Do poker sites look for these types of patterns?”
Screenshots of tracking software show 'JackKlompus' winning $414,200 across 76,700 hands, while 'OxOO' recorded $423,500 across 37,400 hands – a combined $837,700 in tracked winnings.
Patrick Howard, aka Mobius Poker, replied, “Guy was reported probably dozens of times under these different accounts. Sites really dropped the ball here.”
In a report on Poker Red, Spanish player Ignacio Morón claimed that he personally “could have lost between $150K and $200K,” and said figures he had seen put Gregg's alleged winnings at around $1M on ACR Poker and $1.5M on GGPoker.
Morón added that he was refunded $60K after CoinPoker banned the account ‘Europe’.
He argued that poker sites need to communicate with each other to ensure information about suspected cheaters is shared.
"If you go to Las Vegas and any casino catches someone cheating, all the casinos know it – they have the picture and if you go into another casino they kick you out too.”
Could sites work together to protect players?
That raised the question of whether information about the banned account could have been shared with other operators.
Leonard responded, “Every site bans people every day, no site has ever told another site the players they have banned. We did not know what he was doing [and that he had] hacked Jurojin/IntuitiveTables.”
Leonard said he is in the player groups discussing the accounts and that “regs have reported these characters to the sites for over a year.”
Leonard also claimed that he has been calling for cooperation between sites for over ten years, but pointed to a number of reasons why it’s problematic.
“It’s unfair if site x spend infinite $ on security whilst site y spends 0 and then site y basically can just rely on site x. There is so much politics right now between the sites, smear campaigns etc that it’s just not feasible for them to work together.”
This is a developing story and we will bring you more news as we get it.
