GGPoker Bans PokerTracker After a Breach PokerTracker Had Nothing to Do With

Picture a normal Thursday night grind. Four ACR tables open, PokerTracker 4 quietly importing in the corner, and you click the GGPoker icon to add a couple of tables there too. As of October 15, 2026, GGPoker's position is that PokerTracker should not be running at all. Not minimised, not paused, not pointed at a different site. Closed.

That instruction sits halfway down a post GGPoker published on October 15 under the sleepy title New Security Measures at GGPoker. It announces five changes. Read in isolation, they look like routine housekeeping. Read next to the Mesh Agent scandal, they look like something sharper: the world's biggest poker room using a breach on other people's software to finish a war on third-party tools it started years ago, while asking players to let its own client take a much closer look at their machines.

Some of it is overdue and useful. Some of it is a land grab with a security badge pinned on. Here's how to tell which is which.

The Breach GGPoker Won't Name

The word "Mesh" appears nowhere in GGPoker's post. The incident behind it is no mystery, though. Between June 2025 and January 2026, an attacker intermittently swapped the update packages served to a chosen group of Jurojin users (a session and productivity suite popular with grinders) for tampered builds. Those builds carried a remote-access agent built on MeshCentral, which is legitimate open-source IT software that lets an administrator view and control a computer from anywhere. IntuitiveTables, a table-management overlay, was reportedly compromised as well. Once the agent was on a target's PC, whoever ran the server could watch that player's screen, hole cards included. We pieced the whole operation together in our long read on online poker's first supply-chain superuser.

Jurojin called it "a highly targeted operation, not a mass attack", aimed at roughly 30 high-stakes players. High-stakes reg Ignacio "Nacho" Morón has said he lost between $100,000 and $200,000 to the suspect account, about $60,000 of it in a single 15-minute session.

GGPoker never says it was touched by any of this, but the fingerprints are all over its post: a reference to "the recent incident", a screen-blocking feature pitched against remote-access software "whether you installed it or not", and both compromised tools sitting on its new banned list. Nothing in the post suggests GGPoker's own servers were breached, which matches what the researcher who exposed the scheme said from day one. The weak point was never the poker room. It was the players' PCs.

Ten Names on the List, Two With a Mesh Connection

GGPoker says it used to tolerate some tools that didn't affect gameplay, and that "following the recent incident" it's tightening up. The new policy bans outside poker software and automation utilities outright, names ten of them, and tells players to shut them down completely before the client launches. Sort that list by what each tool actually does and whether it had anything to do with the attack, and the picture changes.

Look at who's in the bottom group. Equilab is a free offline equity calculator plenty of players learned the game with. AutoHotkey is a free Windows scripting tool that office workers with zero interest in poker use to remap keys and automate spreadsheets. And then there are the four trackers, which GGPoker has been trying to push out of its players' lives for years. Back in March 2024, GGPoker told PokerStrategy that running trackers on other sites while playing on GG could earn you a warning, and that it hoped tracker makers would stop supporting GG altogether.

The irony writes itself. In February 2026, GGPoker's own blog suggested downloading your hand histories for offline review in tools like PokerTracker. Eight months later, PokerTracker has to be fully closed before you launch GGPoker. Compare that with CoinPoker, which banned HUDs in June 2026 but, per PokerListings, still lets a tracker for other rooms stay open as long as it's disabled while CoinPoker runs. GGPoker offers no such carve-out. If you multi-site, it now wants your desktop to itself.

GGPoker does have a real argument, and it's worth stating fairly. Every program running next to the client is one more thing that can be poisoned, and fewer programs means a smaller target. Security people call that reducing the attack surface, and it's sound. The trouble is that Mesh didn't arrive because PokerTracker was open. It arrived inside a tampered update, and a tampered update can ride in on anything: a Discord patch, a browser extension, a "free" cracked solver. Banning HUDs to stop the next Mesh is like banning umbrellas to stop floods.

Meanwhile the GG client ships with its own Smart HUD and PokerCraft stats. Every grinder forced to close an outside tracker is a grinder whose data now lives entirely inside GGPoker's ecosystem. That may be a side effect. It is a very convenient one.

The Client Wants a Look Around

Now the useful bit. A new Client Security area in GGPoker's settings adds four switches. Screen Guard blocks your tables from being captured, recorded, streamed or remotely viewed, so a Mesh-style agent sees a blank where your hole cards should be. A "Protect the whole Client" option extends the cover to the cashier, the lobby and your account screens. Connection Monitor flags programs making dodgy connections, think remote-desktop software or proxies. Allowed Processes lets you whitelist software you trust, and DNS Check looks for signs that your network traffic is being redirected.

Screen Guard is the one feature in the whole package that goes straight at the actual attack, and credit where it's due. Credit also to the room that got there first. On October 6, 2026, ACR announced ScreenShield, which blocks capture and sharing tools from grabbing table content, switched it on for players who met its detection criteria, and said it had sent other operators guidance on building similar protection. "Because player security is bigger than competition," said ACR boss Phil Nagy. Nine days later, GGPoker has its own version. Players win either way. Notably, ACR's response didn't touch its HUD rules.

Here's the uncomfortable part. To protect you from software that watches your machine, GGPoker's client now has to watch your machine more closely. Flagging apps with suspicious connections means knowing which apps are running and who they're talking to. GGPoker's own first-look screenshot shows exactly that: a Detections tab listing running programs by process name, publisher and "last seen" time (svchost.exe, TeamViewer.exe, Edge), with a Report button sitting on top. To be fair, the example is clever: it flags a "Discord.exe" whose digital signature belongs to AnyDesk, which is precisely the kind of disguise a planted remote tool would wear. Enforcing "close PokerTracker before launch" means checking that same process list. GGPoker hasn't explained how it will detect banned tools, but its own Security & Ecology Policy already reserves the right to scan a user's machine or device.

Is that a trojan? No, and the difference matters: a trojan hides what it does, and GGPoker has told you. But disclosure only gets you halfway. The post doesn't say what gets sent when you hit Report, whether process lists or Connection Monitor findings otherwise leave your PC, whether they're stored, or whether they can be used against you in a security review. And while the four security switches are optional, the tool ban isn't.

Your Win Rate Gets a Second Opinion

The most interesting change is invisible. GGPoker has added a detection method it calls WAD, short for Abnormally High Win-Rate. Instead of only scanning hand histories for the usual suspects (collusion, ghosting, bots, real-time assistance), WAD grades every decision against what the opponent was really holding. A superuser has a very specific fingerprint: he folds the second-best hand, snaps off the bluff, and does it at a rate no honest read could explain. GGPoker says it tested WAD on old data and found past cases.

Poker has seen this movie before. In 2007, the Potripper account on Absolute Poker was exposed on the TwoPlusTwo forums by players who noticed someone playing as if every card was face up. Absolute eventually acknowledged seven accounts cheating over a 40-day stretch and promised $1.6 million in refunds. Nearly two decades later, the Mesh case followed the same script. Coach Patrick Howard sent GGPoker a review of 32,780 hands on September 1, 2026, and, as we reported in our follow-up, didn't hear back until October 2, after the press had the story. That's 31 days. WAD is GGPoker automating what Howard did by hand.

Good. Long overdue, but good. Two things are missing from the announcement, though. There's no word on how WAD handles a player on a real heater, where a few thousand hands of well-timed hero calls can look a lot like clairvoyance. And there's no mention of an appeal route for anyone it flags. For a room that confiscates balances, both deserve a paragraph.

Coinbase, a Wallet and a Lot of Blank Space

The section GGPoker titles "Supporting the Victims" is the closest it has come to admitting the case reached its tables. It says it traced the funds to a crypto wallet, believes they were deposited at Coinbase, and has asked Coinbase to restrict the account and preserve its records. It has also flagged the wallets to blockchain-tracing networks and to law enforcement. Coinbase is a large US-listed crypto exchange that verifies its customers' identities, which is why this matters to poker players: if the money really landed there, a real name is probably on file somewhere.

That's real progress. Now look at what isn't there. No number of affected GGPoker players. No dollar figure. No confirmation that an account was banned or a balance seized. And for a section with "victims" in the title, no refund commitment at all. Compare that with December 2023, when GGPoker caught a player exploiting its own client and published both the confiscated sum, $29,795, and a promise to give it back to the players affected. The room knows how to write that kind of statement. This time it chose not to.

The New Minimum Is Already Retired

Last and least dramatic: GGPoker will stop supporting Windows 7, 8 and 8.1, plus macOS 11 Big Sur and older, at an unspecified point in 2027. The new minimum is Windows 10 on PC and Monterey (macOS 12) on Mac, on the reasoning that systems without security patches are an open door. Fair enough, except Windows 10 itself reached end of support on October 14, 2025. Home users only keep getting security fixes if they're enrolled in Microsoft's Extended Security Updates programme, which runs until October 12, 2027. The logic GGPoker applies to Windows 7 will catch up with a much bigger chunk of its player base soon enough.

Patrick Howard said early on that this scandal "will change online poker forever." October 15 is what that change looks like at the biggest room in the game: a client that can hide your cards from spies, a statistical net that finally works the way grinders' spreadsheets always did, and a policy that treats your tracker, your equity calculator and your hotkey script as suspects. GGPoker says it will post updates as the case develops. The next one should come with numbers.

Sources: GGPoker, New Security Measures at GGPoker (October 15, 2026) and Security & Ecology Policy; Jurojin statement via PokerNews (September 30, 2026); Casino.org (October 5, 2026); GlobalPokerSites.com Mesh Agent coverage (October 1 and 3, 2026); ACR press release via WebWire (October 6, 2026); PokerStrategy (March 4, 2024); PokerListings (June 2026); HighStakesDB (December 30, 2023); Microsoft Windows 10 ESU page.