ACR Makes ScreenShield Default on 4 November as Poker Malware Losses Are Put at $1.5m–$4m

Americas Cardroom (ACR), the flagship room of the Winning Poker Network (WPN), will make its ScreenShield setting the default on 4 November 2026, as new reporting on the poker malware scheme puts player losses between $1.5 million and $4 million.

The decision follows a WPN review of more than 2 million hands. It lands as WIRED's 28 October report on compromised poker-tool updates draws fresh attention to how remote-access software reached players' machines. Nobody has been charged.

What ACR and GGPoker have decided

ACR's change is the clearest operator response so far. NewsForAgent reported on 17 October that WPN plans to turn ScreenShield on by default on 4 November. WPN reviewed more than 2 million hands played from computers where MeshAgent, a remote-access program, was detected. About 200,000 of those hands were tied to the central account at the heart of the case. WPN said it found no evidence that anyone used knowledge of opponents' hole cards.

NewsForAgent also reported that WPN closed the account holder's account. Casino.org reported that ACR rejected refunds for affected players.

GGPoker has also moved. According to Tightpoker, the room set 1 December as the enforcement date for a ban on third-party software. GGPoker's own announcement is the basis for that report, and the operator's full terms should be read before players adjust their tooling.

For operators weighing how to respond, the contrast is useful: ACR is adding a protection setting for everyone, while GGPoker is restricting the tools players can run. Readers following the wider US and European poker market, including Betsson's French poker license and Playtech iPoker plans, can expect integrity measures to be part of licensing conversations.

How the compromise reportedly worked

Jurojin and IntuitiveTables, two makers of poker software, said compromised builds of their tools put remote-access software on some players' Windows PCs. The disclosure followed a researcher's report on 29 September 2026. The researcher found no compromise of the poker sites' own clients, according to Pokertube.

WIRED, as summarized by The Hack Academy, described the chain of events this way:

• The attacker reached Jurojin's update system.
• A remote-access agent then reached IntuitiveTables' developer.
• Malicious code was added to a build before it was signed.
• The code reached only users on a list of usernames.

These details come from press reporting rather than a forensic report. The reported route, a build altered before signing, places the focus on vendors' release pipelines rather than on the poker sites themselves. Reports differ on how long the compromised builds circulated. The Hack Academy, citing Card Player, puts Jurojin's last compromised month at June 2026.

One player's account

A player identified only as Alex, a pseudonym, told PokerShield that a Claude AI agent flagged MeshAgent on his computer. PokerShield dates his discovery to 25 September. He logged 11 screen-monitoring events, all on ACR. An opponent using the name "OxOO" appeared in 10 of those sessions. Alex estimates his own loss at about $30,000.

That case shows why the ACR hand review matters to players. WPN's statement addresses hole-card knowledge specifically, while players continue to dispute the outcome of their own sessions.

Losses and affected users: the numbers

The figures in circulation measure different things.

The loss range is an estimate, not an audited total. The gap between more than 1,000 recipients and 10 to 30 possibly affected computers suggests the sources count different groups.

Patrick Leonard, a CoinPoker ambassador, said the account had been on that platform for under a week, according to The Hack Academy citing Card Player and Gaming Compliance News.

No charges, and what players can do

Dark Web Informer reported that the accused individual has not been charged with a crime. Other outlets have named an alleged operator. No court or regulatory finding has been cited, and Gamingo is not naming anyone. The person is presumed innocent.

For players seeking redress after a dispute with an operator, independent complaint mediation has produced results before; see how AskGamblers recovered over $9 million for players in 2023. With ACR reportedly declining refunds, that route may matter to affected players. ACR's own events and promotions, such as its Montenegro high-stakes trip, sit alongside a security question that its player base will now ask more often.

In the US, where new rooms are being planned, two new online poker rooms are due in Nevada. Regulated operators there face their own approval and integrity requirements for any tools players use at the tables.

What to watch

• Whether ScreenShield goes live on 4 November as planned.
• GGPoker's 1 December third-party software enforcement date.
• Any further statements from Jurojin, IntuitiveTables, WPN or CoinPoker.
• Any police, regulator or court action.

Status reviewed on 2 November 2026. Loss figures and operator decisions come from press reports of WIRED's findings and from NewsForAgent, PokerShield and Casino.org. More igaming news and North America coverage.