GGPoker sets Dec. 1 for ban on PokerTracker 4, Hand2Note and other third-party tools

GGPoker will start scanning for banned third-party software on Dec. 1, and players who ignore warnings could be suspended or banned. Because many of the tools were already barred at GGPoker tables, the larger change falls on players who run trackers for other sites on the same computer.

• GGPoker announced five new security measures on Oct. 15 in response to the remote-access superuser scandal.
• Ten programs are on GGPoker's banned list, including PokerTracker 4, Hand2Note, Holdem Manager 3, DriveHUD 2 and AutoHotkey.
• From Dec. 1, an automatic in-client warning system will look for banned tools, and players who ignore a warning could face temporary suspension or a permanent ban.
• Starting Oct. 23, GGPoker will gradually upgrade its built-in multi-tabling features to replace functions lost to the ban.

GGPoker will begin enforcing its ban on third-party poker software on Dec. 1. From that date an automatic in-client warning system will look for banned tools, and players who ignore a warning could face temporary suspension or a permanent ban, the operator said in a follow-up statement reported by PokerStrategy.com. The ban is the most disruptive of five security measures GGPoker announced on Oct. 15 after the remote-access superuser scandal, and it ends the operator’s long-standing allowance for HUDs, trackers and table-management tools.

Ten programs are named. The list covers Jurojin, PokerTracker 4, Hand2Note, Holdem Manager 3, StarsCaption, DriveHUD 2, Intuitive Tables, Lobbyze, Equilab and AutoHotkey. Two of them, Jurojin and Intuitive Tables, are the tools that were compromised in the scandal.

Dec. 1 enforcement hits multi-site PokerTracker 4 and Hand2Note setups

For many players at GGPoker tables, the ban changes less than the headline suggests. Many of the listed apps already could not be used on GGPoker tables, PokerFuse reported. What changes is that the GGPoker client will no longer run at all while any of them is open on the computer.

That shifts the burden onto a specific group: players who keep PokerTracker 4, Hold’em Manager 3 or Hand2Note running for other sites while also playing on GGPoker from the same machine. Their combined setup stops working. Under the new rules, a session on GGPoker means closing the tracker first, which affects how serious players study and multi-table across rooms.

Developers face their own condition. GGPoker told third-party tool makers they must remove all compatibility with the GG network before their software is taken off its warning list. A tool that still reads GG hands, in other words, stays flagged.

Jurojin and Intuitive Tables sit at the center of the breach

The scandal traces back to tampered software updates. In a security notice dated Oct. 1, Jurojin Poker said an attacker swapped in tampered update packages for one group of its users on and off between June 2025 and January 2026, and that some of those packages contained a remote-access tool.

Jurojin described the attack as a targeted operation by a known cheater who went after specific high-stakes opponents to see their hole cards. The same person, according to Jurojin, also targeted IntuitiveTables and ran phishing sites posing as poker rooms and tools.

Three operators were named in the scandal: GGPoker, CoinPoker and ACR Poker. Police authorities have been notified of the case, according to GGPoker, which also said it followed the money trail and passed details of the crypto wallets on to Coinbase and to industry networks.

Win-Rate Anomaly Detection and Screen Guard target hole-card access

The software ban is only one piece of the package. Under Win-Rate Anomaly Detection, GGPoker reviews the decisions players make, looking for a level of precision that would suggest someone can see the cards an opponent is holding. That approach looks at outcomes at the table rather than at what is running on a player’s machine.

A new Client Security area adds four optional tools: Screen Guard, Connection Monitor, Allowed Processes and DNS Check. They are meant to protect private information and flag suspicious connections or network activity, PokerFuse reported. Screen Guard stops screenshots and screen recording of open tables, according to PokerNews, which addresses the kind of screen access used against high-stakes players in the scandal.

Taken together, the measures work on two fronts. The tool ban and Allowed Processes limit what can sit beside the client. The anomaly detection is aimed at anyone who gets through anyway.

Jurojin objects as ACR and CoinPoker take separate steps

Not every developer accepts the approach. Jurojin Poker called the blanket ban heavy-handed, argued for cooperation and shared security standards instead, and urged GGPoker to reconsider and talk with the developers and players affected, Poker.org reported.

The other two named operators responded differently. ACR answered with its Screen Shield feature to block remote screen viewing, while CoinPoker says it banned the suspected account a year earlier. CoinPoker ambassador Patrick Leonard said the site had banned an account called ‘Europe’ and refunded the players it affected.

GGPoker’s decision raises pressure on US-facing and regulated operators to decide where they stand on third-party software. ACR has chosen a screen-blocking feature. In GGPoker’s case, the restriction sits in the client itself, which refuses to run whenever a banned program is open alongside it.

To cover the gap, GGPoker is building table swapping, layout locking and focus management into its own client, and says operating-system window management tools will still be allowed, PokerStrategy.com reported. The first of those upgrades begin rolling out gradually on Oct. 23, ahead of the Dec. 1 enforcement date.

Image: screenshot of jurojinpoker.com