Start Grinding for FREE!
Security Notice: Update Package Incident (June 2025 – January 2026)
We want to share what happened, what we've done about it, and what you should do if you were affected.
What Happened
We want to thank Wolf. This came to light through a closed high-stakes group on Discord. This week, our investigation found that between June 2025 and January 2026, an attacker was able to intermittently replace the update package delivered to one specific group of Jurojin users with a tampered version. The infection timeframe did end in January 2026. The last version uploaded was not infected, probably so the attacker could cover their tracks and the file would not look unusual if someone inspected it by hand. Some of those packages included a remote-access tool.
This was a highly targeted operation, not a mass attack. It was carried out by a known cheater aiming at specific opponents, mostly at high stakes, with the goal of viewing their hole cards remotely. Jurojin was one of several applications targeted by the same actor, including IntuitiveTables. The same actor also operated phishing sites impersonating poker rooms and well-known poker tools.
Who Was Affected
Our records identify a limited group of accounts that may have been served a tampered update during that period. Not all tampered packages contained the remote-access tool, and exposure does not mean a device was infected. Several people were caught up in the tampered-software side of this operation, but only a handful of high-stakes players were harmed by actually playing against the attacker while their hole cards were exposed. Most affected users did not face that in-game harm. As a precaution, we have contacted every one of these users privately by email from support@jurojinpoker.com.
Our records may not capture every case. If you did not receive an email but want to be sure, please run our check tool or contact us. Also, if you want to be extra safe, just format your PC.
What We've Done
Nothing else was uploaded to our servers after January 28, 2026. We have logs of every compromised version and the dates it was served. We contacted cybersecurity authorities, along with anti-fraud and law-enforcement authorities, and gave them all of that information, as well as the rest of our findings.
Once we had the full picture this week, we went further:
Every download from our servers is now logged.
Administrative actions have stronger audit trails.
Access to sensitive configuration has been further restricted.
Key places where data is edited or deleted on our servers now require multiple authentication factors.
Amazon Web Services support was contacted for more logs.
We are in contact with investigators and security teams to gather data.
We are working with poker room security teams and with Wolf, the independent cybersecurity expert leading the investigation.
What You Should Do
If you received our email, if you saw something suspicious on your PC, if it has been running slower than usual, if you feel someone has been playing against you and always winning, or you notice similar signs: we recommend a clean Windows reinstall from scratch (format to zero). That is the best way to be sure the PC is safe.
If you decide not to reformat, you can check your PC with Jurojin Mesh Check. A clean result is not a guarantee:
Screen names to report to the rooms
If you played against these accounts and believe the attacker saw your hole cards, report the hands to the room and ask about a refund of the money taken by that illegal play.
Compensation and refunds are the rooms' responsibility. They are the ones who can validate fair play and analyse game patterns. We cannot do that analysis, and we should not. The rooms hold the hand histories and the account records that a refund depends on.
These names come from community investigations. They are accusations. No official public investigation has confirmed them, and we have not independently verified each screen name. Those reports attribute the accounts to one person, named there as Paul Gregg.
One report placed Europe on WPN. The reports that name a room for that account place it on CoinPoker, which is the room listed here. ACR is the main WPN room. No screen name in these reports was exclusive to ACR.
Sources: PokerExclusive, SpadePoker, GipsyTeam, pokerfuse, FunFarm, Frankie Carson.
Always run the latest version of Jurojin, downloaded only from jurojinpoker.com.
Keep your antivirus up to date, and leave Windows Defender turned on.
Please stay alert to impersonation. We will never ask for your passwords and we will never send you attachments. The only official check tool is the one on jurojinpoker.com.
Indicators of Compromise
For security teams, other poker tools and technical users. Do not visit these addresses.
The same server hosted phishing sites impersonating poker rooms, casinos and poker apps. Players who use any of these could be targeted:
Casinos and poker rooms: Bodog, Ignition, ACR Poker, GGPoker, PokerKing, Winning Poker Network, BCPoker.
Apps and tools: IntuitiveTables, fake casino domains, and similar apps or sites are or could be compromised.
Phishing Domains
okayvpn[.]org www-bodog[.]eu acr-poker[.]eu www.acr-poker[.]eu xn--winningpokernetwork-h0c[.]com xn--posolver-tkb[.]com www.xn--posolver-tkb[.]com netverify[.]org www.netverify[.]org ignitioncasino[.]cc www.ignitioncasino[.]cc ignitioncasino[.]email www.ignitioncasino[.]email winningpoker[.]network www.winningpoker[.]network ggnetwork[.]org www.ggnetwork[.]org pokerking[.]email intl.pokerking[.]email acrtabletalker[.]com www.acrtabletalker[.]com hand2note[.]org www.hand2note[.]org winningpokernetwork[.]com bcpoker[.]eu gtosoftware[.]com wpnpoker[.]com
How It Worked
How an update works, and how this one was changed
The attacker swapped the update package served to specific users. Some of those packages included a remote-access tool.
We were able to corroborate every historical version of the software that was served, and which of those versions were malicious and which were not. It was always a selective attack on that specific group of players, carried out by hand by the actor, not a mass or automated blast.
We have extensive reports of our findings for authorities and security teams who are interested. Some of them already have those reports.
Our Commitment
We're sorry. Our users trust us with software that runs on their computers, and that trust was abused.
Security remains a priority for us despite this specific case. The improvements we made throughout the year show that. Stronger authentication, rotated keys, and the other changes we put in place left the attacker unable to continue the scheme, even though we did not yet know about it. That was a side effect of work we had already done.
We still suffered the attack. For the future, we will be better prepared. We will keep this page updated as the investigation progresses. For any questions, reach us at support@jurojinpoker.com.
Thank you again to Wolf and to everyone who got involved in gathering as much information as possible and in talking through this incident with us. We remain actively attentive to new attacks or discoveries.
— The Jurojin team