Danger online: how scammers hack online poker

Over the past 20 years, online poker has changed significantly. However, despite improvements in protection systems, scammers still find ways to gain an unfair advantage over their opponents. And the scheme in almost all such known cases comes down to one thing — finding out the opponent's cards. To do this, scammers use viruses, poker room vulnerabilities, and even inside help. Let's look at how this happened and what punishment the fraudsters received.

Paul Gregg and the Mesh Agent trojan

The story of player Paul Gregg and his scheme using the Mesh Agent trojan became known quite recently. However, it is very likely that the fraudster had already been active for more than two years.

According to a cybersecurity researcher under the handle "wolfsec0x0", the first infection occurred back in March 2024. Since then, the malicious software has infected more and more computers. This happened through hacked poker software — Jurojin and Intuitive Tables — as well as through phishing emails and websites.

The agent used the legitimate open-source remote access program MeshCentral. It was installed on victims' computers without their knowledge, ran in the background, had full control of the device, and hid its files.

The fraudster — or possibly a group of fraudsters — acted selectively. Mesh Agent was mostly installed on the computers of high-stakes cash game players competing on major rooms, including GGPoker, WPN (ACR Poker), and CoinPoker. The trojan allowed the attacker to see everything happening on the screens of the affected players, including their cards during poker games, as well as passwords and bank card data.

At the same time, the scammer tried to cover his tracks: he deleted the agent and wiped scripts from the computers of some victims, sometimes played suboptimally so as not to attract the attention of the rooms' security teams, and, according to one player's theory, deliberately lost at low stakes to lower his winrate.

Paul Gregg acted under his real name on GGPoker; the accounts "JackKlompus", Ez[Pz], and OxOO on ACR Poker, and Europe on CoinPoker are also linked to the scheme. Coin ambassador Patrick Leonard said that Gregg was banned from the room as far back as two years ago. The security team determined that he was doing something prohibited, blocked his account, and confiscated $100,000. Gregg insisted on his innocence, wanted his money back, and complained to the gaming commission, but then went quiet.

From June 2025 to June 2026, the fraudster periodically swapped the Jurojin update package for a fake one aimed at a specific group of users. These modified versions contained the remote access tools.

The fraudster was identified after one player discovered a trojan on his computer and found that it was transmitting data whenever Paul Gregg and OxOO were seated at the same table with him. The subsequent investigation gathered the necessary evidence: MeshAgent logs, hand histories, and timing records of the malicious agent's connections to the control servers.

According to preliminary estimates, around 30 players were affected by Paul Gregg's actions. On ACR Poker alone, his profit exceeded $837,000. The very first, as yet unconfirmed, figures suggested that over the two years the scheme existed, the fraudster earned about $2 million.

One of the affected poker players, Gleb "psyhoagromor" Kovtunov, after the public outcry revealed that he had been accusing Gregg of cheating in private messages since April. In August, he voiced his suspicions in the high-stakes antiRTA group, and shortly after that the fraudster won a large sum and stopped appearing at the tables.

The response from the rooms and companies to the unfolding scandal was swift. Jurojin has already conducted an investigation, during which it identified all the hacked versions of its software. The developers also strengthened security measures to prevent repeat attacks and gathered reports for authorities and poker room security teams.

Intuitive Tables launched a full-scale investigation and determined that there is no malicious code in the current publicly available versions of their application. Details of the attack and the builds affected by it are still being clarified.

GGPoker published a warning on its website asking players to check their computers for Mesh Agent. ACR reported that it is actively working on the situation and has already applied additional precautionary measures for affected players. And from October 2 to 4, the network's CEO Phil Nagy will hold a series of streams answering questions about the virus. Furthermore, according to some reports, information about the fraudster has been passed on to the FBI and other law enforcement agencies.

How to check your computer

• In the Start menu, type "PowerShell", right-click on Windows PowerShell, and select "Run as administrator".

• Copy all the lines below into the window that opens and press Enter.

• If there are no mentions of Mesh Agent or Mesh Central, then the program was not found on your computer. If something is mentioned, then the agent was either installed at some point or is still installed. The check can detect it even if the fraudster has removed it, since it leaves traces in Windows.

What to do if you find Mesh Agent?

• Disconnect your computer from the internet, but don't delete anything yet, since the data may be useful for the investigation.

• Using a clean device, change the password for your email first, and then for poker sites, cryptocurrency exchanges, and other important accounts.

• Log out of all accounts and enable two-factor authentication, so the fraudster no longer has access to your accounts.

• Contact your bank and ask them to replace all cards whose details are saved in your browser.

• Move cryptocurrency from wallets installed on the infected computer to a new wallet created on a clean device.

• Report the trojan infection to the security team of the poker site you play on, as well as to your local police or anti-fraud service.

• After handing over evidence to the competent authorities, format the hard drive and reinstall Windows. Simply deleting the agent is not enough to get rid of the malware.

Superuser on GGPoker

Just a few months before the first detection of Mesh Agent, the community was rocked by a scandal involving a superuser on GGPoker. A player under the nickname "MoneyTaker69" showed an incredible 90 BB/100 winrate over a sample of 8,900 hands in December 2023, by exploiting a vulnerability in the poker room's client. This story led to Jason Koon's departure from his position as GGPoker's fairness ambassador, which we mentioned in Fedor Holz's biography.

In his fraudulent scheme, MoneyTaker69 exploited a flaw in the table reactions feature, which played an animation of a thumbs-up or thumbs-down. The player modified the poker client, making changes to its code after decompiling it. This allowed him to intercept traffic and send modified data packets to the servers.

MoneyTaker69 did not see opponents' hole cards directly, but he received data from GGPoker's servers about opponents' pure all-in equity on the flop and turn. This allowed him to make mathematically flawless calls and bluffs.

MoneyTaker drew attention with his strange and extremely loose playing style. His VPIP — voluntary contributions of money to the pot preflop — was 53%, while his preflop raise rate reached 16.7%. With such parameters, the fraudster's winrate should have been around -50 BB/100, and the massive gap with his actual stats caught the attention of other players.

On December 16, GGPoker's security team noticed abnormal activity and disabled the thumbs-up/thumbs-down reaction with an emergency patch. But MoneyTaker blocked automatic updates to his hacked client, which allowed him to continue exploiting the vulnerability for several more weeks before his ban.

During the period he used this scheme, the fraudster won the GGMasters Sunday tournament with a $150 buy-in, beating a field of over a thousand players and earning $47,586. He also made the final table of a $1,000 event but failed to win it. These results reduced the likelihood of chip dumping or the opponents having a virus.

Curiously, even as MoneyTaker's honesty was already in serious doubt, some players still admired his "skill". British poker player Andy Wilson wrote on his X:

"MoneyTaker is on a completely different level, and it would be a true miracle if we ever see a player with his skill again. Helmuth breaks records. MoneyTaker69 breaks the rules. You can keep your stats. I prefer magic."

However, the admiration didn't last long. On December 29, GGPoker announced that it had blocked MoneyTaker's account and confiscated $29,785 from him. The room also promised to redistribute the $47,586 the scammer won from the tournament victory, and reported implementing solutions designed to prevent players from attempting to modify the poker client.

Still, this response to the situation did not satisfy everyone. CardPlayerLifeStyle journalist Eddie Harari had already written an article about GGPoker's vulnerabilities back in January 2022, but the network's security team ignored the evidence he provided. After the announcement of MoneyTaker's ban, he noted in the comments on the room's post that he could still see opponents' hole cards with a delay of a few seconds, just as he could when writing his article.

Later, Harari added that the fraudster may have accomplices who continue to exploit the same vulnerability. Part of the community felt that GGPoker chose to quickly hush up the situation by banning one dishonest player instead of ensuring greater transparency and taking more serious security measures. This issue was especially acute given that in September 2023, the network had banned the use of SharkScope, which helps proactive players analyze large amounts of data and identify suspicious users.

It's worth noting that at the same time, the community noticed a similar case on 888poker. There, a player under the nickname "DivVal24", playing at NL10-NL20 stakes, posted a 175 BB/100 winrate over 8,200 hands. Initially, there were suspicions that this was another superuser.

But a little later, Andrey "TylerRM" Streltsov found several accounts that had lost the most money to DivVal24. What all these accounts had in common was that they had never played before and quickly became inactive. This gave rise to a theory of chip dumping. 888poker quickly responded to this forum discussion, and the very next day reported blocking all suspicious accounts. And in January 2024, it was revealed that the room had returned almost $363,000 to players affected by bots and opponents using real-time assistance (RTA).

The "POTRIPPER" scandal

Before MoneyTaker69, one of the most high-profile superuser cases was the scam carried out by a player under the nickname "POTRIPPER" on Absolute Poker in 2007. But unlike the GGPoker fraudster, this scammer could see opponents' hole cards directly, since he had insider access and a "god mode", and was likely connected to one of the site's executives.

POTRIPPER attracted attention in September 2007 when he won a tournament with a $1,000 buy-in and a guaranteed prize pool of $100,000, despite having only entered three low-stakes events before that. At the final table, he won 56 out of 93 hands, never lost a single showdown, and made the correct decisions in 16 key river spots.

In the final hand against Marco "CrazyMarco" Johnson, POTRIPPER called an all-in with nothing but 10-high on a board of 4♥️K♦️K♥️7♠️5♠️. This won the fraudster the tournament and $30,000, since Johnson had shoved on the turn with 9♥️2♥️ and a flush draw that never came in.

Johnson suspected his opponent of cheating, and other players also reported POTRIPPER's suspicious behavior during the tournament. After this, CrazyMarco contacted the room's support team to obtain the tournament's hand history for analysis. However, the manager mistakenly sent him not a simple text log, but a file containing data normally hidden from regular users: players' hole cards, IP addresses, and observer account logs.

This file contained more than 90 of POTRIPPER's hands from the start of the tournament. Johnson passed the document on to other members of the TwoPlusTwo forum for review. Mathematician Michael Shackleford calculated that POTRIPPER's winrate exceeded the norm by 15 standard deviations. The probability of that is roughly the same as winning a 1-in-1,000,000 lottery six times in a row.

It turned out that Absolute Poker's software code had a hidden account called "User 363", which could be used to join any table as an observer and see players' hole cards in real time. It had been created for finding and fixing bugs, tracking correct pot distribution, and verifying the proper functioning of the random number generator.

User 363 was not meant to be active during games. However, the fraudsters found a way to use this account for their own purposes. The person controlling it either passed information about opponents' cards to POTRIPPER in real time, or used both accounts simultaneously.

The investigation found that six more accounts were linked to POTRIPPER: "Graycat", "Steamroller", "Doubledrag", "Payup", "Supercard55", and "Romnaldo". And the IP address of the User 363 account led to Absolute Poker's servers and office in Costa Rica. The observer account turned out to be linked to one of the room's founders, Scott Tom, and his friend, company manager AJ Green.

Initially, Absolute Poker denied all the fraud allegations, but later admitted to the problem anyway. However, the room pinned all the blame on a senior consultant who allegedly developed a sophisticated system for manipulating internal systems to gain access to users' hole cards.

The site's regulator, the Kahnawake Gaming Commission (KGC), reported in November 2007 that the fraudulent scheme had been operating for around 40 days in August–September. It was also established that Absolute Poker's management had deleted game logs during the investigation.

As punishment, the KGC imposed a $500,000 fine on the room and placed it on a 2-year probationary period under enhanced commission oversight. Absolute Poker also reported paying $1.6 million in compensation to affected players. However, the identities of those responsible for the fraudulent scheme were never revealed.

Writer Ben Mezrich said that Scott Tom categorically denied any involvement in the fraud. Mezrich also said that Absolute Poker's management did not reveal the name of the main culprit because they had struck a deal with him:

"Absolute Poker's executives claim they came to this guy and offered him a deal: if he told them exactly how much he stole and how he did it, he would be allowed to leave the company without any consequences and his name would not be revealed. According to them, this was someone who held an operational position and had access to everything. But these guys never once told me who it actually was."

Russ Hamilton — WSOP champion and fraudster

The POTRIPPER and Absolute Poker scandal is closely tied to a very similar story that occurred on UltimateBet. These two rooms were merged into a shared network, Cereus Poker Network, in 2008, although they had belonged to the same company, Tokwiro Enterprises, since 2006. In addition, both sites operated under a license from the Kahnawake Gaming Commission.

UltimateBet, however, had existed since 2001 and appeared two years before Absolute Poker. The 1994 WSOP Main Event champion Russ Hamilton played an important role in the room's popularity. The regular became a consultant for the network and, thanks to his media presence, helped attract genuine stars to promote it: Phil Hellmuth and Annie Duke.

But soon after launch, in June 2003, a fraudulent scheme began operating on UltimateBet. It was similar to the one uncovered at Absolute Poker: "god mode", insider access, and hacked observer accounts that allowed users to see players' hole cards. This vulnerability was exploited for almost five years, until January 2008.

The scheme involved 23 accounts that used 117 usernames to cover their tracks and make detecting the fraud more difficult. However, one of them, "NioNio", still drew attention due to an abnormal winrate. This user won more than $600,000 before being discovered.

Players noticed NioNio's extraordinarily aggressive and flawlessly precise playing style and began studying the statistics to back up their suspicions with facts. Lawyer and poker pro Serge Ravitch told journalists:

"What I saw made no sense at all. This account was simply winning too much money for its style. When another player bluffed, he always went all-in. When another player had a stronger hand, he always folded."

After a series of complaints and discussions on forums, UltimateBet launched its own investigation and later brought in its regulator, the KGC, to handle the case. In September 2008, the commission confirmed the existence of a superuser who was winning dishonestly. The scheme implicated 31 people, but Russ Hamilton was identified as the main person responsible for the fraud. The majority of the devices and IP addresses used belonged to him.

As a result of the fraudsters' actions, amateur and professional players lost more than $22 million. Among those affected was Hollywood actor Ben Affleck, who reportedly lost around $500,000, and well-known regular Mike Matusow. The American poker player said that his losses on UltimateBet totaled $1.5 million:

"I lost probably $1.5 million and got back $375,000. I was sure I was being cheated. It felt like they could see my cards. I called Russ and told him something was wrong, and he said they had the most secure system and that I was just running bad. He personally invited me to play heads-up. I'd deposit $50,000, then more, and more. And I kept losing. I couldn't figure out what was going on."

In 2013, the key piece of evidence against Hamilton surfaced. His personal computer technician, Travis Makar, published a recording of the WSOP champion's conversation with UltimateBet's management, secretly made in 2008. In it, Hamilton admitted to stealing between $16 and $18 million through superuser accounts. However, he then went on to discuss with the room's management ways to minimize payouts to the affected players.

In the end, the KGC ordered UltimateBet to return all $22 million earned dishonestly, pay a $1.5 million fine, and fire and strip the licenses of all employees involved in the fraudulent scheme.

Russ Hamilton personally, however, faced no punishment. He was not sentenced to prison or ordered to pay a fine. The reason was that online poker existed in a legal gray area. There were no laws in the US that would have allowed criminal charges to be brought against a member of a company operating under Canadian jurisdiction. In addition, key evidence in the form of various recordings remained under UltimateBet's control and was either incomplete or altered.

Peter Jepsen's Trojan horse

Peter Jepsen's poker career started off promisingly. In 2007, the Danish player won the European Poker Tour Main Event in Warsaw and earned $415,679. However, he would later go down in history as a fraudster.

Jepsen began resorting to gaining an unfair advantage as early as 2008. And in some ways, he acted even more brazenly than the other scammers featured in this article. Peter, together with accomplices, physically installed trojans on high-stakes regulars' computers. The Dane gained remote access to the victims' devices and could see opponents' hole cards while playing against them.

Sometimes Jepsen sent phishing emails to other players, opening which led to the installation of the virus. He could also install the malicious code via a USB flash drive. To do this, he only needed to plug it into a port, after which the process would launch automatically. Another way of spreading the trojan was selling infected laptops to players at very attractive prices.

Jepsen's accomplices often broke into victims' hotel rooms during live poker series and uploaded malicious code onto their computers within minutes. One of those likely affected was Finnish high roller Jens Kyllönen. During the EPT Barcelona stop in 2013, he noticed his laptop was missing from his hotel room.

While Kyllönen was dealing with the hotel staff about the situation, the fraudsters had already returned his laptop. However, the device later disappeared again and was found by security on another floor. The Finnish regular wrote that he felt like he was going crazy from these disappearances and his growing sense of anxiety.

Later, Kyllönen ran into Romanian player Liviu Ignat in the elevator, who told him that his laptop had also been stolen. The poker players joined forces in searching for the thieves, but the hotel staff and the security team of PokerStars, which organized the EPT stop, were unable to help them quickly. The police were soon brought in.

It was not possible to identify Jepsen during the Barcelona tournament. Only in the fall of 2014 did Danish authorities begin proceedings against Peter. This happened after a group of eight anonymous players filed a joint complaint with the police.

The basis for the lawsuit was that regulars noticed abnormal losses in games against Jepsen or people connected to him, and also began finding suspicious files on their computers. Alex "AlexKP" Petersen and Jakob "Lottenice" Rasmussen are believed to have been among those affected by this scheme.

The main blow to the fraudster came when three of his accomplices made a deal with the investigation. They said they had been involved in installing the virus on victims' computers. This became one of the main pieces of evidence against Jepsen.

The proceedings took five years. The investigation managed to prove thefts totaling around $3.9 million. In December 2019, Copenhagen City Court sentenced Jepsen to prison. Reports of the exact term vary — some sources say three years, while Danish media reported that Peter was sentenced to 2.5 years, with six months credited due to the length of the investigation.

Jepsen did not admit guilt and filed an appeal. In December 2020, a higher court issued a new verdict, and it turned out to be even stricter. Jepsen's prison sentence was increased to three years, with the confiscation of around $3.6 million. One of the victims received a payment of €107,000.

There is perhaps no way for an ordinary player to protect themselves from superusers with "god mode", or from the sophisticated method of infecting a computer via poker software. But the scandal surrounding Peter Jepsen prompted security experts to remind regulars: their laptop could become a target for fraudsters.

To minimize risks, a number of important rules should be followed. You need to encrypt your hard drive and protect all important accounts with complex passwords. In addition, it's worth changing your passwords from time to time, avoiding connecting to poker rooms through unverified networks, and consulting professionals if you suspect a hack.

And the Mesh Agent story once again prompted the community to raise questions about the security of poker rooms and the work of their security teams. These issues are especially pressing given that the fraudster was once again identified thanks to the efforts of the users themselves, who analyzed large amounts of data.

Will platforms' approach to security change after such a high-profile scandal? And what specific measures will poker rooms take to protect their users? We assume we'll find out the answers to these questions in the near future.