A second poker software vendor has confirmed it was hit by the same supply-chain campaign that compromised Jurojin Poker, widening a cybersecurity story that started as a poker scandal and is turning into a case study in third-party software vendor risk. IntuitiveTables, a desktop add-on used by online poker players to track live table data, told users on September 30, 2026 that a “known cheater” had tampered with its software to install spyware on specific players’ machines, according to a statement read on camera by poker pro Charlie Carrel and reported by p4poker.com.
The disclosure matters beyond the poker world. Two unrelated software vendors, serving the same niche customer base, both had their update or distribution pipelines turned into a delivery mechanism for a remote-access tool. That is the textbook definition of a software supply-chain attack, the same category of risk that security teams at banks, hospitals, and SaaS companies spend budget trying to catch before it reaches an audit committee. For Jurojin, which issued its own statement, reported by PokerNews on October 1, 2026, and now for IntuitiveTables, the poker angle is almost incidental. The real story is what happens when a small, trusted desktop tool becomes an attacker’s preferred entry point.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
A Second Poker Software Vendor Confirms It Was Hacked
IntuitiveTables is one of several third-party overlay tools poker players install alongside a site’s own client to track hands, stats, and table history. Unlike Jurojin, whose statement to PokerNews described a tampered update package distributed between June 2025 and June 2026, IntuitiveTables has not yet disclosed the exact window its software was compromised. What the company did confirm, according to the statement relayed by Carrel and documented by p4poker.com, is that the intrusion was targeted rather than broad: a specific actor went after several poker applications with the goal of installing spyware on the machines of specific high-stakes players, and IntuitiveTables was one of the tools used to do it.
That detail is the thread connecting the two incidents. Neither Jurojin nor IntuitiveTables is describing a smash-and-grab breach aimed at harvesting as much data as possible. Both are describing a narrow, patient operation against a short list of named targets, which is a very different threat model than the ransomware campaigns that dominate most 2026 breach headlines. It also means the usual breach math, record counts, dollar figures, exposed databases, does not map cleanly onto this story, and reporters and readers should resist the urge to force it into that shape.
What IntuitiveTables Told Users
According to the statement read by Carrel and reported by p4poker.com, IntuitiveTables put the number of affected players at around 30 worldwide, a figure that lines up with the independent researcher estimate of roughly 10 to 30 players across Europe, North America, and Oceania that first surfaced the broader campaign on September 29, 2026. The company said it has opened a full investigation and that its team has verified the versions currently available to the public contain no malicious code.
What the statement did not include is notable too. IntuitiveTables has not named which versions were compromised, has not given a start or end date for the tampering, and has not said how the malicious code was introduced into its distribution pipeline, whether through a compromised build server, a hijacked update signing process, or a phishing attack against an employee. Those are the questions a forensic incident response team would answer first, and until IntuitiveTables publishes more, outside analysts are working from a partial picture. The same caveat applies to Jurojin, whose statement to PokerNews was more specific about dates but similarly silent on the technical root cause.
Inside the MeshCentral Remote-Access Tool
The payload identified in the compromised packages is based on MeshCentral, an open-source remote monitoring and management platform normally used by IT administrators to manage fleets of Windows machines. That is a detail worth sitting with. The attacker in this campaign did not need to write custom malware from scratch; legitimate, well-documented remote-management software was repurposed and installed without consent, reportedly running as a Windows service with full system privileges, according to the p4poker.com writeup of the researcher’s findings.
Security teams use the term “living off the land” for attacks that lean on tools already trusted by the operating system or already present in the target environment, because signature-based antivirus has a harder time flagging software that is, on its face, legitimate. MeshCentral is open source and widely used for benign purposes, which is exactly what makes it attractive to an attacker trying to stay under the radar on a victim’s machine for months. Reporting on the campaign indicates the malware persisted on some victims’ computers for months, and in at least some cases more than a year, before detection.
A security engineer auditing a Windows fleet for unauthorized remote-access services would typically start with something as simple as enumerating running services and cross-referencing binaries against a known-good list, the kind of baseline check that catches an unexpected MeshCentral agent before it catches a human analyst’s attention months later.
Get-Service | Where-Object {$_.Status -eq "Running"} |
Select-Object Name, DisplayName, @{N="Path";E={(Get-WmiObject Win32_Service -Filter "Name='$($_.Name)'").PathName}} |
Where-Object { $_.Path -notmatch "Microsoft|Windows" } |
Export-Csv unverified_services.csv -NoTypeInformation
That is roughly the level of basic hygiene third-party risk frameworks ask vendors to demonstrate, and it is the kind of check that, had it run against a tampered update package earlier, might have shortened the window between compromise and disclosure in both the Jurojin and IntuitiveTables cases.
Timeline: How the Poker Software Supply-Chain Attack Unfolded
Piecing together the public record from PokerNews and p4poker.com produces the following sequence. Exact figures below are drawn from company statements and the researcher’s initial writeup; where a number is disputed or unconfirmed by a second outlet, it is marked as such.
| Date | Event | Source |
|---|---|---|
| March 16, 2024 | Earliest activity later traced to the broader campaign, per the researcher’s investigation | p4poker.com |
| June 2025 | Jurojin’s statement says tampered update packages began reaching one specific user group | PokerNews |
| June 2026 | Jurojin identifies this as the last month a compromised package went out | PokerNews |
| September 29, 2026 | Independent researcher publicly discloses malware distributed through compromised poker tools | p4poker.com |
| September 30, 2026 | IntuitiveTables statement read on camera by poker pro Charlie Carrel | p4poker.com |
| October 1, 2026 | Jurojin’s detailed statement reported, including direct outreach to affected users by email | PokerNews |
| October 2, 2026 | Story continues to develop; no poker operator’s own backend confirmed breached | PokerNews, p4poker.com |
One figure circulating in secondary coverage, an allegation that criminals obtained close to $900,000 through exploits on the WPN poker network, has not been independently confirmed by PokerNews or p4poker.com and should be treated as unverified rather than established fact. Readers chasing a single dollar figure for this story will not find one yet; the companies involved have been specific about player counts and vague about financial impact.
Jurojin and IntuitiveTables: Two Vendors, One Campaign
It is worth being precise about what is and is not shared between the two incidents. Both Jurojin and IntuitiveTables are third-party desktop tools, not poker sites themselves. Both say roughly 30 players were targeted. Both describe the operation as highly targeted rather than a mass compromise. Both say current public versions are clean. Neither has published a root-cause analysis of how its build or distribution pipeline was breached in the first place, and neither has disclosed whether the same attacker, tooling, or infrastructure was used against both companies, though the overlap in victim profile, high-stakes players, and payload type, a MeshCentral-based remote-access agent, makes a shared campaign the working theory among the outlets covering it.
| Detail | Jurojin | IntuitiveTables |
|---|---|---|
| Tool type | Poker software suite | Table-tracking overlay tool |
| Disclosed compromise window | June 2025 – June 2026 | Not disclosed |
| Players affected (company figure) | ~30 high-stakes players | ~30 worldwide |
| Malware vector | Tampered update package | Not fully disclosed; same campaign suspected |
| Payload | Remote-access tool (per PokerNews) | MeshCentral-based agent (per p4poker.com) |
| Current public versions | Said to be clean | Verified clean by internal team |
| Direct user notification | Confirmed, by email | Not specified in public statement |
The pattern of two vendors in the same niche market getting hit within roughly the same window, by what looks like the same payload family, is the part security researchers tend to flag before dollar amounts or player counts: it suggests an attacker who studied the ecosystem closely enough to know which tools serious players actually install, rather than one who scattered malware broadly and got lucky.
Why This Is a Software Supply-Chain Story, Not Just a Poker Story
Software supply-chain attacks, where an attacker compromises a trusted vendor’s distribution channel rather than attacking the end target directly, have been one of the defining cybersecurity patterns of the past five years, from SolarWinds in 2020 to the npm and PyPI package-poisoning incidents that security teams now track routinely. What makes the poker-tool campaign a useful, if small-scale, case study is that it shows the pattern playing out in a market segment with almost none of the vendor-risk infrastructure that banks or cloud providers require of their suppliers. Poker players installing a table-tracking overlay are not running vendor security questionnaires or demanding SOC 2 reports before they click install.
That gap is not unique to poker software. The same dynamic shows up anywhere a small, specialized vendor builds a tool that a professional community trusts implicitly: trading bots, streaming overlays, modding tools, even browser extensions aimed at a niche hobby. Readers who followed the 275% rise in ransomware-linked data theft against schools and hospitals this year have seen a version of this same lesson play out at larger scale: attackers increasingly go after the software and vendors that sit between them and a target, rather than the target itself, because the vendor’s defenses are often thinner.
The Compliance and Vendor-Risk Angle
Corporate compliance and risk-management publications have spent much of 2026 writing about third-party and fourth-party risk, the idea that an organization’s security posture is only as strong as the weakest vendor in its software supply chain, a theme Corporate Compliance Insights covers regularly for enterprise risk and compliance teams. The poker-tool incidents are a small-scale, consumer-facing version of the exact failure mode those publications warn about in corporate settings: a trusted update channel became the attack surface, and the end users had no practical way to vet the vendor’s internal controls before installing the software.
For actual enterprises, the lessons translate directly. Build-pipeline integrity, code signing that is actually verified rather than just present, monitoring for anomalous update packages, and a tested plan for notifying affected customers quickly are the same controls that show up in frameworks like NIST’s supply chain risk management guidance and in ENISA’s threat landscape work on software supply-chain attacks. Neither Jurojin nor IntuitiveTables has published the kind of detailed root-cause disclosure that would let outside analysts judge whether those controls existed, failed, or were simply never built, which is itself a data point: smaller software vendors, even ones serving demanding, security-conscious users, often do not have a mature incident-disclosure process ready to go when something like this happens.
Market Impact: Vendor Risk Spending Meets a Niche Industry
Online poker software is a small market compared to enterprise SaaS, but the market impact here is less about the size of the poker-tool industry and more about what it signals to adjacent, better-funded sectors. Companies that sell security and vendor-risk tooling, the same category covered when detection engineering teams write Sigma rules to catch new threat patterns, have an incentive to point to incidents like this as proof that even narrow, low-revenue software niches are viable attack vectors. Expect vendor-risk and software composition analysis vendors to cite the poker-tool case in sales material aimed at gaming, fintech, and other verticals that rely on specialized third-party desktop or overlay software.
There is also a narrower market effect inside poker itself. High-stakes online players who install multiple third-party tools, tracking software, table overlays, HUDs, now have a concrete reason to question every one of them, which could slow adoption of new or smaller poker-adjacent software products until vendors demonstrate better update-pipeline hygiene. That mirrors what happened in the broader remote-access software space after unrelated vulnerability disclosures, including TeamViewer’s recent patch for five flaws, the worst rated CVSS 8.8, where a trusted remote-access brand had to rebuild user confidence through patching speed and transparency rather than marketing.
Historical Context: Poker’s Long Fight With Cheating Software
Online poker has a two-decade history of software-enabled cheating scandals, long before this week’s disclosures. The industry’s “superuser” scandals of the mid-2000s involved site insiders able to see opponents’ hole cards directly through backend access, a different mechanism but the same end result as the MeshCentral-based spyware described this week: an unfair informational advantage obtained through software rather than skill. What is different in 2026 is the attack surface. Two decades ago the risk was concentrated in the poker operator’s own backend. Today, players run a sprawling stack of third-party tools, trackers, HUDs, table-selection software, built by small independent developers with far less security investment than a licensed operator, and that stack is now the softer target.
That shift matters for anyone tracking how cheating and fraud evolve alongside software ecosystems generally. The incentive structure, a small number of very high-value targets, in this case high-stakes players with money directly on the line, combined with a fragmented, lightly secured vendor ecosystem, is a close cousin of what shows up in gaming, crypto trading, and esports, anywhere a niche industry builds a dense layer of third-party tools around a core platform without a matching layer of vendor security oversight.
Competitive Comparison: How Poker Tool Vendors Are Responding
Beyond Jurojin and IntuitiveTables, the broader field of poker overlay and tracking software has stayed largely quiet publicly, which is itself a competitive signal. Neither PokerNews nor p4poker.com has reported other named vendors confirming compromise as of October 2, 2026, and major poker platforms, including GGPoker and ClubWPT Gold, have been explicitly named by PokerNews as not involved in the backend compromise. That distinction, third-party tool versus platform backend, is the one piece of reassurance operators can offer players right now, even as it does little to reassure users of the affected third-party tools themselves.
How a software vendor responds in the first 72 hours after a disclosure like this, speed of notification, clarity about what is and is not confirmed, and willingness to publish a technical post-mortem, has become its own competitive differentiator in security-conscious markets. Compare the vendor-communication pattern here to how cloud infrastructure providers now have to move on disclosure speed, a dynamic also visible in reporting on tooling built specifically to stop credential and secret leaks before they reach a build pipeline, the exact category of control that might have caught a tampered update package earlier in either the Jurojin or IntuitiveTables timeline.
What Players Should Do Now
For the roughly 30 to 60 players collectively named across both company statements, and for the wider base of high-stakes players who use either tool, the practical guidance from both companies is consistent: update to the current version, which both vendors say has been verified clean, and watch for direct contact from the vendor if you were part of the affected group. Jurojin has said it contacted affected users directly by email; IntuitiveTables’s public statement did not specify a matching notification process, which is itself worth following up on for any player uncertain about their own exposure.
Players running either tool, or similar third-party poker overlays, on a Windows machine used for real-money play have a concrete, low-effort step available: check installed and running services for anything unrecognized, the same basic hygiene check security teams run against enterprise endpoints, rather than assuming antivirus alone would have flagged a repurposed legitimate remote-management tool. That same logic is behind why security teams elsewhere are leaning on structured detection content, including the kind of open-source vulnerability scanning that can flag an unauthorized service before it is discovered by accident months later.
Predictions: Where This Story Goes Next
- More third-party poker tools will likely confirm they were targeted in the same campaign over the coming weeks, given the pattern of two vendors disclosing within 48 hours of each other.
- Expect at least one of the two companies to publish a more detailed technical post-mortem once their investigations close, under pressure from affected high-stakes players who have financial incentive to understand exactly how they were exposed.
- Poker operators will likely issue their own guidance to players about vetting third-party software, even though PokerNews reporting indicates operator backends were not directly compromised.
- Vendor-risk and software supply-chain security vendors will use this incident as a reference case in materials aimed at niche software markets outside poker, from trading tools to streaming overlays.
- The unverified allegation of roughly $900,000 in losses tied to the WPN network will either be confirmed by a named outlet or quietly drop out of coverage within the next reporting cycle, since neither PokerNews nor p4poker.com has substantiated it as of this writing.
What This Means for Software Vendors Outside Poker
The IntuitiveTables and Jurojin disclosures land at a moment when build-pipeline integrity is already under scrutiny across the software industry, from large-scale open-source package registries to enterprise CI/CD systems. The specific lesson for smaller, specialized software vendors, the kind that built a loyal niche user base without ever needing enterprise-grade security operations, is that a dedicated, patient attacker does not care how small your company is if your users are individually valuable enough. High-stakes poker players, each capable of winning or losing tens of thousands of dollars in a session, are exactly that kind of high-value, low-volume target, and the attacker in this campaign appears to have understood that math better than either vendor’s security program did.
That is the real takeaway for any engineering team maintaining an auto-update mechanism, regardless of industry: an update channel is a privileged execution path into every customer’s machine, and it deserves the same scrutiny as a production database credential, not the lighter touch many small vendors give it.
Frequently Asked Questions
Was any online poker platform’s own software hacked?
No. PokerNews reporting explicitly states that GGPoker and ClubWPT Gold were not involved, and the compromise is tied to third-party desktop tools, not any poker operator’s backend.
What is IntuitiveTables?
It is a third-party table-tracking overlay tool poker players install alongside a poker site’s own client, separate from Jurojin, which is a different poker software suite also confirmed compromised.
How many players were affected?
IntuitiveTables put its own figure at around 30 players worldwide, consistent with an independent researcher’s estimate of roughly 10 to 30 players across Europe, North America, and Oceania for the broader campaign, according to p4poker.com.
What malware was used?
Reporting identifies a remote-access agent built on MeshCentral, an open-source remote monitoring and management platform, reportedly installed without consent and run as a privileged Windows service.
Is the current version of these tools safe to use?
Both companies say their currently available public versions have been verified to contain no malicious code, though neither has published full technical detail on how the compromise occurred.
Did criminals steal money from players?
A secondary report alleges close to $900,000 in losses tied to the WPN network, but this figure has not been independently confirmed by PokerNews or p4poker.com and should be treated as unverified.
Is this the same attacker behind both the Jurojin and IntuitiveTables incidents?
Neither company has confirmed a shared attacker, but the overlapping victim profile, similar player counts, and matching payload type have led outlets covering the story to treat it as one campaign targeting multiple poker software vendors.
What should affected players do?
Update to the latest verified-clean version of either tool, watch for direct vendor contact, and check for unrecognized background services on any Windows machine used for real-money play.
Related Coverage
- Jurojin Poker Confirms Hack, 30 Players Hit [2026]
- TeamViewer Patches 5 Flaws, Worst Hits CVSS 8.8 [2026]
- Pentagon Breach Exposes 3.05M Military Records [2026]
- Beyond Identity vs HYPR vs Transmit: $200K Price Gap [2026]
- Arizona Court Data Breach Exposes 150K Foster Files [2026]
