A disturbing new security allegation has emerged in the online poker world, with claims that high-stakes players have been targeted by malicious remote-access software capable of exposing everything visible on their computers — including their hole cards.
The claims surfaced this week from an anonymous X account describing themselves as a cybersecurity professional. They have not yet been independently established, and no affected poker site or player has been publicly identified.
That distinction matters. Despite early discussion using the familiar poker term “superuser”, the allegations do not currently suggest that somebody gained special access inside a poker site’s own software.
What is being alleged?
According to the claims, a covert remote-access agent was installed on the Windows computers of around 30 users, reportedly all high-stakes poker players.
The alleged malware could allow an attacker to watch a victim’s screen in real time. In a poker game, that would potentially reveal the player’s hole cards as they played.
The same access could be much more serious than poker cheating alone. The claims suggest an attacker could potentially access information displayed elsewhere on the computer, including browser sessions, saved credentials and other sensitive data.
The person making the allegations says the activity dates back to 2024 and involved third-party software rather than the poker clients themselves.
GGPoker and ClubWPT Gold specifically ruled out
No poker room has been publicly accused of facilitating the alleged compromise.
In fact, the source behind the claims specifically stated that GGPoker and ClubWPT Gold were not involved. The allegation instead centres on third-party software used by poker players.
The software vendors have also not been publicly named, with the source saying they were actively responding to the issue and that current versions were no longer serving the allegedly malicious code.
Why the “superuser” description is significant
Online poker has a long and uncomfortable history with superuser scandals.
The term became infamous following the Absolute Poker and UltimateBet scandals of the 2000s, where privileged access allowed opponents’ hole cards to be viewed. More recently, GGPoker banned the account “MoneyTaker69” in 2023 after a vulnerability was exploited to gain an unfair informational advantage.
The current allegation appears technically different. If the claims are accurate, an attacker would not need privileged access to the poker site’s servers if they could instead compromise an opponent’s computer and watch the screen directly.
That makes the story potentially important beyond any individual poker room. Serious online players commonly use a collection of third-party tools alongside their poker clients, and a compromised utility could create a security risk regardless of how secure the poker platform itself may be.
More evidence still needed
For now, the poker community is waiting for substantially more information.
No list of affected players has been released, the third-party software involved has not been publicly identified and the central claims remain allegations from an anonymous source.
But if the evidence ultimately supports those claims, the incident could raise a difficult new question for online poker security: protecting the integrity of the poker client may not be enough if attackers can instead target the computers of the players sitting at the table.