Superuser Scandal: Poker Sites Were Warned About Suspicious Account Before Cheating Losses

By PlayVideoPoker News Team

New details in the online poker superuser scandal show that two poker sites were alerted about a suspicious account before it allegedly cheated a high-stakes player out of six figures. The account, known as “Paul Gregg,” is at the center of a cheating ring that used third-party software to view opponents’ hole cards. The story has ignited fresh concerns about security in online poker and video poker platforms.

The scandal first came to light when cybersecurity expert @wolfsec0x0 posted an analysis on X, revealing that attackers had gained remote access to players’ screens through compromised third-party poker software. According to the investigation, roughly 30 high-stakes players were targeted. One of the accounts involved in the operation was Paul Gregg.

Victims and losses

Spanish poker pro Ignacio Moron has been one of the most vocal victims. He told Poker Red, a Spanish outlet covering the scandal, that he estimates losing between $100,000 and $200,000 to the Paul Gregg account. In one 15-minute session, he lost $60,000. Moron believes the account had access to his hole cards through a software breach.

One of the two sites that received warnings took immediate action. High-stakes player Mario Mosbock, an ambassador for that unregulated site, confirmed that its security team detected the superuser account more than two years ago. The site confiscated $100,000 from the account and banned it. Patrick Leonard, also a site ambassador, wrote on X that the account was caught “around 1 year ago after he had played less than a week on the site.” Leonard added that “it was obvious he had more information than other players.”

A warning went unheeded

Poker coach Patrick Howard of Mobius Poker submitted a formal report to GGPoker in September 2026, flagging suspicious behavior from the Paul Gregg account. Howard, who has said the scandal “will change online poker forever,” did not outright accuse the account of cheating but asked for a thorough investigation. On Friday, Howard posted on X that GGPoker had reached out to him about the case.

But according to Patrick Leonard, a group of around 100 poker players had voiced their concerns about the Paul Gregg account to multiple sites years earlier. “He somehow was allowed to continue playing on those sites, winning and withdrawing at win rates that were likely not possible and showdowns that didn’t make sense,” Leonard wrote. He added: “The future of online poker is in the hands of the sites and how much they are willing to investigate and act on bots & standalone characters like this.”

Software vulnerabilities exposed

The breach affected several third-party poker software products. Jurojin Poker, one of the compromised tools, released a statement describing the attack as “a highly targeted operation, not a mass attack.” The company said the same actor also targeted IntuitiveTables and operated phishing sites impersonating poker rooms and well-known poker tools. Jurojin has taken steps to prevent future compromise.

This is not the first major superuser scandal in online poker. The most notorious remains Russ Hamilton’s “POTRIPPER” account, which cheated players on Absolute Poker and Ultimate Bet in the late 2000s. The current case, while smaller in scale, has reignited fears about software-based cheating.

What this means for video poker players

While the Paul Gregg scandal involves online poker, the same security principles apply to video poker platforms that use third-party software for tracking, analysis, or game play. Players who rely on external tools should verify that those tools are from reputable providers and that the poker site has robust security monitoring. The fact that a warning from dozens of players went unheeded for years is a reminder that site oversight is not always immediate.

For now, the full extent of the cheating remains unclear. It is not yet known how many sites were affected or how much money was stolen overall. The investigation is ongoing, and players are urged to report any suspicious account behavior to site security teams.

Source: PokerNews, “Superuser Scandal: Poker Sites Were Warned About Suspicious Account”, https://www.pokernews.com/news/2026/10/poker-sites-warned-about-superuser-account-52532.htm