Open-Source Superuser Detection Software Released Following Poker Scandal

The online poker world has been rocked by a high-profile scandal involving a remote-access Trojan hidden in tampered software. This exploit allowed attackers to view opponents' screens and hole cards in real-time, affecting over two dozen high-stakes players. In a significant move toward transparency and security, AceGuardian Research by A5 Labs has released its entire anti-cheat playbook and code repository on GitHub. This release allows any operator or researcher to run automated superuser detection on their hand histories, aiming to prevent future security breaches of this nature.

The incident first surfaced last month when accusations emerged regarding compromised tools, specifically Jurojin Poker and IntuitiveTables. Jurojin later confirmed that a highly targeted operation between June 2025 and June 2026 replaced their legitimate update packages with tampered versions. The attacker allegedly used this exploit to win significant sums on various sites, including GGPoker, before security systems and manual reviews flagged the suspicious play.

Numbers and facts

A detailed case review published by AceGuardian highlights the scale of the cheating. Over a ten-week period, a suspect played 757 hands at $25/50 stakes, with 95 percent of these occurring in heads-up matches. The suspect won approximately $45,000 across 14 sessions. One specific 250-hand session saw the suspect win $15,300, a figure far beyond normal statistical expectations for such a small sample size. The detection system flagged 72 suspicious hands where the player made hyper-optimal decisions against the opponent's specific hidden cards.

The software utilizes sophisticated metrics to identify anomalies. One key metric is the Oracle-fold ratio, which measures how often a player folds a hand that is ahead of an opponent's range but behind their specific actual holding. The suspect in the reported case showed an Oracle-fold ratio on the turn of 92.9 percent, placing them in the 100th percentile of all players. Additionally, the suspect's bluff success rate was 39.5 percent, compared to a population median of 26.6 percent.

Background

AceGuardian was founded in 2019 and currently works with seven platforms, analyzing tens of millions of decisions daily. The team is led by Dr. Thanh Tran, a former computer science professor at the Karlsruhe Institute of Technology and a former Visiting Assistant Professor at Stanford. John Andress, a former high-stakes professional, serves as the Head of Game Integrity. Their methodology does not rely on a single data point but flags cases only when multiple signals—such as equity comparisons, bluff indices, and win-rate outliers—align over a significant number of hands.

"The methodology and Python/data pipeline are publicly available on GitHub for operators to implement and run on their hand histories." - Dr. Thanh Tran, CEO of AceGuardian

By making the software open-source, AceGuardian is providing smaller operators and individual players with tools previously reserved for major platforms. The goal is to create a community-driven approach to game integrity where data can be verified independently of the poker rooms themselves.

Why it matters for German players

For players in Germany, this development is particularly relevant as the market is strictly regulated under the Interstate Treaty on Gambling 2021 (GlüStV 2021). The German regulator, GGL, mandates that all licensed operators maintain high technical standards and fraud prevention mechanisms. The release of open-source detection tools adds an extra layer of scrutiny to the market. German players are protected by deposit limits via the LUGAS system, which helps mitigate the financial impact of potential cheating, but the integrity of the game remains paramount. Using GGL-licensed sites ensures that there is a legal framework for addressing such scandals, unlike playing on unregulated MGA or Curacao platforms.

What it means for GGL-licensed casinos

Licensed operators in Germany can now integrate these open-source tools into their existing integrity systems to better comply with GGL requirements. Since German law requires the reporting of suspicious activity, having access to academically-backed detection models for RTA (Real-Time Assistance) and superusers is a major advantage. It allows for a more standardized approach to security across the industry. While German slots have a 1 Euro per spin limit, poker stakes can be much higher, making automated detection systems essential for maintaining a fair ecosystem and protecting the house and the players alike.