GGPoker Bans Third-Party Tools After Remote-Access Compromise
The poker room has also added screen protection, suspicious-process alerts and decision-level integrity monitoring.
- GGPoker now requires players to close all prohibited third-party poker software before launching its client.
- The ban names HUDs, table-management products and shortcut tools including Jurojin, Intuitive Tables, PokerTracker 4 and AutoHotkey.
- The action follows compromised Jurojin and IntuitiveTables builds that installed remote-access software on some users’ computers.
- New optional client protections include Screen Guard, connection monitoring, process checks and DNS checks.
- GGPoker will stop supporting several older Windows and macOS versions in 2027.
GGPoker has banned third-party poker software and automation tools that run alongside its client, ending a policy that had allowed some applications which did not directly affect play. Players must fully close prohibited programs before starting the GGPoker client.
The restriction covers software that accesses game data or interacts with tables, including HUDs, table-management tools and shortcut programs. Named examples include PokerTracker 4, Hand2Note, Holdem Manager 3, DriveHUD 2, Equilab, Jurojin, Intuitive Tables, StarsCaption, Lobbyze and AutoHotkey, though GGPoker has not presented the list as exhaustive.
PokerTracker 4 can be used to track bankrolls, retain hand histories for study and display opponent statistics during play. AutoHotkey can create shortcuts for actions including bet sizing, checking, calling and folding. GGPoker said outside applications create risks when they access game data, interact with tables, automate actions or handle player information beyond the operator’s control.
The policy arrives after compromised builds of Jurojin and IntuitiveTables installed the MeshCentral remote-access agent on some Windows computers. A security researcher’s report on Sept. 29 preceded confirmation from the two products, which are used for table management and multi-tabling. The issue was in those third-party tools rather than poker-site clients.
The agent, a legitimate open-source remote-management product, was installed without users’ knowledge through code-signed versions of the tools. It gave its server operator a live view of an affected screen and control of the computer. The researcher estimated that 10 to 30 computers across Europe, North America and Oceania were affected, with the earliest confirmed activity dating to March 16, 2024.
The identified computers had the agent removed or disabled, and neither product was still delivering it. Jurojin said June was the final month in which it served a compromised version, and said it privately emailed affected users and kept logs of compromised releases and delivery dates.
As we reported in September, Jurojin had recently supplied WPT Global with security-approved hotkeys, bet-sizing controls and table-sizing tools. Jurojin has now called GGPoker’s blanket prohibition “heavy-handed,” arguing that security threats should not mean treating the entire third-party software ecosystem as the threat, and urged operators, developers and players to cooperate on standards and communication instead.
Alongside the ban, GGPoker has added a Client Security section to Game Settings. Its four optional tools work only while the GGPoker client is open and are not a replacement for antivirus protection across a player’s computer.
Screen Guard is designed to stop screenshots, recordings, screen shares and remote-viewing applications from displaying poker tables and hole cards. A “Protect the whole Client” option extends that protection to the lobby, cashier and account pages, including wallet balances, histories and personal details.
Connection Monitor warns of applications with suspicious connections, including remote-control software and proxies. Players can mark trusted programs through Allowed Processes to avoid alerts, while DNS Check looks for signs of DNS hijacking. The Client Security menu also includes Process Check.
GGPoker has also added Win-Rate Anomaly Detection, or WAD, to its integrity monitoring. The system assesses each decision against the cards an opponent actually held, looking for choices that are correct far more often than legitimate play would permit. The company said testing against past cases found those cases, and described WAD as an addition to checks for collusion, ghosting, bots and real-time assistance.
GGPoker said it traced funds connected to the incident, identified a related cryptocurrency wallet and shared its findings with Coinbase, where it believed the funds were deposited. It asked the exchange to restrict the associated account and preserve records, and reported wallet addresses to illicit-fund tracking networks and law enforcement.
Support for Windows 7, Windows 8, Windows 8.1 and macOS 11 Big Sur or earlier ends in 2027. GGPoker recommends players move to at least Windows 10 or macOS 12 Monterey, saying the unsupported operating systems no longer receive manufacturer security patches and expose accounts to modern exploits and critical risks.
