GGPoker Bans All Third-Party Poker Software, Launches Four New Client Security Features

Following the SuperUser breach, GGPoker banned all third-party tools including PokerTracker 4 and Hand2Note, and introduced screen guard, connection monitoring, process checks, and DNS protection.

Original report cover · PokerStrategy
Original report cover · PokerStrategy

Author: PokerSlate AI-assisted editorial desk · Editor: PokerSlate separate AI editorial review

Published:

Incident Trigger: From Tool Vulnerability to Blanket Ban

On October 16, 2026, GGPoker announced a series of security updates via its blog, the most significant change being a comprehensive ban on all third-party poker software and automation tools. The decision was a direct response to the previously exposed SuperUser incident—in which attackers obtained hole-card information of high-stakes players through tampered Jurojin and Intuitive Tables update programs.

Banned Software List

The tools GGPoker explicitly listed as banned include: Jurojin, PokerTracker 4, Hand2Note, Holdem Manager 3, StarsCaption, DriveHUD 2, Intuitive Tables, Lobbyze, Equilab, and AutoHotkey. The platform emphasized that this list is not exhaustive—any software capable of accessing game data or interacting with tables falls within the prohibited scope.

PokerStrategy reported that Jurojin Poker expressed opposition to the ban, arguing that third-party tools themselves should not be treated as a source of threat. This position touches on a key distinction: Jurojin as a normally operating piece of software is not malicious, but its update channel was hijacked and turned into an attack vector.

Four New Client Security Features

SoMuchPoker detailed four optional security modules GGPoker added under the client's "Game Settings," all running only while the GGPoker client is open:

  • **Screen Guard**: Blocks screen recording, screenshots, screen sharing, and remote-view applications from accessing tables and hole cards; an additional setting can extend protection to the lobby, cashier, and account pages.
  • **Connection Monitor**: Alerts the player to suspicious network connections, including remote-control tools and proxy programs.
  • **Process Check / Allowed Processes**: Allows players to mark trusted applications so they do not trigger security alerts.
  • **DNS Check**: Detects signs of DNS hijacking on the network, preventing traffic from being redirected to unintended destinations.

GGPoker stated that these features do not replace antivirus software and cannot protect an entire computer.

Win-Rate Anomaly Detection System

Both sources reported that GGPoker introduced a new cheat-detection mechanism: analyzing the consistency between a player's decisions and the actual hole cards held by opponents. When a player makes "correct" decisions at a frequency far beyond what normal play can explain, the system triggers an alert. This approach operates in parallel with existing detection for collusion, ghosting, bots, and real-time assistance.

PokerStrategy noted that the "Paul Gregg" account was originally flagged by multiple platforms through a similar high-win-rate anomaly, and the POTRIPPER incident at Absolute Poker followed the same pattern. SoMuchPoker pointed out that GGPoker has not yet disclosed the specific thresholds for this system, and its effectiveness depends on integration with existing security measures.

Operating System Support End

Starting in 2027, GGPoker will no longer support Windows 7, Windows 8, Windows 8.1, or macOS 11 (Big Sur) and earlier versions. The platform explained that these systems no longer receive vendor security patches and carry a greater vulnerability risk. Affected players must upgrade to Windows 10 or macOS 12 or later.

Fund Tracing and Law-Enforcement Cooperation

SoMuchPoker reported that GGPoker traced funds involved in the incident to a cryptocurrency wallet address and shared the findings with Coinbase, requesting restriction of related accounts and preservation of records. The platform also reported the wallet address to industry networks tracking illicit funds and to law-enforcement agencies. GGPoker stated that the funds have not been recovered and the investigation is ongoing.

Local reading context

Third-party poker tools have long existed in the online poker ecosystem: tracking and analysis software (such as PokerTracker and Hand2Note) records hands and displays opponent data; table-management tools (such as Jurojin and Intuitive Tables) provide multi-table layouts; automation utilities (such as AutoHotkey) allow scripting. These tools do not alter game data themselves, but they require reading client window information to function, creating a grey zone at the security boundary. The core issue in this incident is that when legitimate tools' update channels were hijacked by attackers, software originally used only for assistive analysis became a conduit for remotely reading opponents' hole cards, forcing the platform to redraw the line between "permitted" and "prohibited."

Source report dates: 2026-10-16

Original sources and verification

  • PokerStrategy

    PokerStrategy 2026-10-16 reports that GGPoker banned all third-party poker tools, explicitly listing Jurojin, PokerTracker 4, Hand2Note, Holdem Manager 3, StarsCaption, DriveHUD 2, Intuitive Tables, Lobbyze, Equilab, and AutoHotkey as prohibited; introduced screen guard and win-rate anomaly detection; ended support for Windows 7 and macOS 11 starting 2027; and reported that Jurojin Poker expressed opposition to the ban, arguing third-party tools themselves should not be treated as a source of threat.

  • SoMuchPoker

    SoMuchPoker 2026-10-16 reports that the incident involved remote-access tools installed on players' computers via tampered third-party update programs; GGPoker added four optional client security features (Screen Guard, Connection Monitor, Process Check, DNS Check), all active only while the client is running; introduced win-rate anomaly detection analyzing consistency between decisions and opponents' actual hole cards but has not disclosed specific thresholds; ends support for Windows 7, 8, 8.1 and macOS 11 and earlier starting 2027; traced funds to a cryptocurrency wallet and notified Coinbase and law-enforcement agencies, with funds not yet recovered; the banned-software list is not exhaustive, as any software accessing game data or interacting with tables is restricted.