Canadian Poker Player Paul Gregg Accused of Cheating Using Malware

A Canadian online poker player, Paul Gregg, is accused of cheating by accessing opponents' hole cards using malware. The malware was distributed through compromised third-party software like Jurojin Poker. A self-described cybersecurity professional and poker enthusiast, who goes by “WoflSecOxO” on X/Twitter, said he confirmed someone planted malware on poker players’ computers. The software gave the user access to his opponents’ screens and could see their hole cards. According to WolfSecOxO, Gregg could watch his opponents’ screen in real-time during real-money play, take control of the mouse and keyboard, run commands with full system privileges, and copy files to and from the computer.

Gregg got the malware on the victims’ computer through compromising third-party software. He used Jurojin Poker, and other online poker tools, to get his malware on hard drives. Jurojin is an online poker tool that eases multi-tabling online poker. Earlier this week, Jurojin confirmed its software was compromised and released a statement. This week, our investigation found that between June 2025 and June 2026, an attacker was able to intermittently replace the update package delivered to one specific group of Jurojin users with a tampered version. Jurojin developers said they are working with “Wolf” to further secure their products.

CoinPoker Was First To Catch Gregg In the aftermath of the Gregg scandal, high-stakes regular and CoinPoker ambassador Patrick Leonard revealed that his site was the first to do anything about the accusation. In a series of tweets, Leonard said the site realized something was wrong and confiscated more than $100,000 from Gregg’s account. Then, they distributed the money back to affected parties. Gregg also played on a variety of other sites and networks, including ACR and GGPoker, but neither of those sites took action yet.