Scandal at GGPoker: A Player Hacked His Opponents’ Computers and Saw Their Cards

A new scandal has erupted in online poker. This time, the problem isn’t with the poker platform itself, but with third-party multitabling software used by most professionals. A scammer tampered with updates to this software, gained remote access to the computers of nearly 30 high-stakes players, and viewed their hole cards in real time.

How the Trojan Got onto the poker players’ computers

The main villain of the story is a Canadian player going by the nickname “Paul Gregg”. According to the information that has come to light, the attack did not go through GGPoker’s servers but via a hidden channel: through third-party poker software. The fraudster hacked the Jurojin Poker and IntuitiveTables. Representatives from Jurojin acknowledged that between June 2025 and June 2026, the attacker used stolen login credentials to periodically replace update packages for specific users. The malicious update was not sent to everyone indiscriminately, but only to specific targets. He embedded Mesh Agent—a legitimate component of the open-source IT tool MeshCentral—into the update, which is why antivirus programs did not flag it. Once installed on the victim’s computer, Paul Gregg could see his opponents’ cards in “online” mode.

The malware read the hand history stored on the computer, extracted the players’ names from it, and cross-referenced them with a list of targets—the Trojan was installed only on the computers of those on that list. The scammer carried out a targeted attack against specific regulars at high-stakes tables. One of the victims — Russian high roller Gleb Kovtunov — said he found Mesh Agent on his computer and suspects the attacker tried to cover his tracks when rumors began to spread.

Players’ losses: $60,000 in 15 minutes

Spanish high roller Ignacio Morón is one of the publicly known victims. His losses are estimated at $100,000–$200,000. He lost approximately $60,000 of that in 15 minutes. About 30 players at high-stakes tables were affected. The most troubling part is that the incident with GGPoker isn’t the first on Paul Gregg’s list of scams.

CoinPoker’s security team blocked a player with the username Paul Gregg in 2024

Two years ago, CoinPoker banned an account registered under the name Paul Gregg and confiscated approximately $100,000. The money was returned to the victims. CoinPoker’s security team documented “illegal activity”. Paul Gregg attempted to challenge the ban through the regulator and insisted on his innocence. When CoinPoker prepared the materials for the hearing, he withdrew his complaint. The ban remained in effect. However, Paul Gregg continued to play on other platforms for another two years. In September 2026, poker coach Patrick Howard filed a complaint with GGPoker. In his report, he pointed out anomalous patterns in Paul Gregg’s account: after betting and raising on the river with deep stacks, his win rate on the flop reached 75.6%. The average for players on the site is 58.2%. GGPoker confirmed that it had contacted Howard, but for years ignored the suspicions of about 100 players and was slow to take action.

Software can spy on you—buy only from official retailers

The key mistake made by the victims of the scandal was that they used pirated versions of Jurojin Poker and IntuitiveTables. Saving a few dozen dollars led to huge losses. The main lesson from this story is simple:

A “cracked” version of multi-tabling software can stream your cards to your opponent in real time.

If you use software of unknown origin, you’re always taking a risk. Play1Pay offers a safe and transparent solution: we sell licensed versions of Jurojin Poker and other verified multi-tabling programs. We source all our software directly from the developers. Trojans cannot be embedded in official software versions. Buy your software from us to protect your winnings from scammers.