New open-source superuser detection software publicly released

A5 Labs' AceGuardian Research has released an open-source anti-cheating library on GitHub for detecting high-stakes players in online poker. This comes after a remote access trojan scandal affected more than twenty high-stakes players.

In a recent high-profile "superuser" scandal, a remote access Trojan hidden in tampered poker software exposed players' screens and hole cards. Following the incident, a new open-source anti-cheating manual has been released to help prevent similar incidents from happening again.

AceGuardian Research, a subsidiary of A5 Labs, has released its complete codebase on GitHub, with the goal of enabling any online poker operator or researcher to automate superuser detection of their existing hand history.

AceGuardian has been running anti-cheating systems for online poker operators since 2019, currently working with seven platforms to detect collusion, bots, real-time assistance (RTA), and superuser behavior in tens of millions of decisions every day.

They also accept hand histories submitted by operators or individual players, which are then processed directly through their detection model. For more details, please contact us. research@aceguardian.co。

Event Description

The incident first came to light last month, alleging that someone implanted a remote access proxy on players' computers through infected poker software.

This allowed attackers to remotely view their opponents' screens and hole cards, affecting more than twenty high-stakes online poker players.

It was quickly determined that Jurojin Poker and IntuitiveTables were infected software. Jurojin issued a statement explaining that between June 2025 and June 2026, through a "highly targeted operation," attackers were able to replace the update kit with a tampered version.

The attacker allegedly exploited this vulnerability to win money from players on multiple websites, including GGPoker. Other websites also noticed the suspicious gameplay and banned the "super user."

How to detect superusers

This is where tools like AceGuardian come in; they can perform post-hand evaluations using several key metrics (when the integrity of all hole cards is known):

• Equity Comparison: To measure whether a player's decision-making heavily depends on their equity in the opponent's actual cards, while keeping their equity in the perceived range constant.

• Oracle Discard: Identify folds made with hands that are ahead of the opponent's standard range but behind their specific hidden hand.

• bluff indexTrack the frequency and success rate of low-equity betting and raising on precise hands.

It also considers win rate outliers by comparing bb/100 with other players who have similar hand samples, and decision time by evaluating not only the time alone but also the player's own benchmark.

However, AceGuardian makes it clear that no single signal is decisive. A case is only flagged when multiple signals are consistent across multiple hands.

In the one-on-one case review submitted after the September 29 incident, even the most basic baseline version of its methodology flagged 72 suspicious hands, in which one player made statistically impossible or overoptimal decisions in response to precise hand repetitions.

Over a period of more than ten weeks, the suspect played 757 hands at the $25/50 level, including 95% in 14 heads-up matches, winning approximately $45,000 in those matches. Half of the matches lasted less than 30 hands. In the remaining matches, the suspect won approximately 1,800 to 8,800 per $ match, except for one match of 250 hands in which he won approximately 15,300 per $ match.

Case scoring sheet

This table displays data comparing the suspect to their opponents, as well as head-to-head reference data for the overall field and the top 10 winners. It also shows the median value for the $25/50 head-to-head group.

Calling on operators and the community to take action

This methodology and Python/data pipeline are publicly available on GitHub for operators to implement and run in their hand history.

They also offer other free services to the community, such as tracking the poker industry ecosystem through the new play and learning platform QuintAce.

AceGuardian also accepts hand histories submitted by operators or individual players, which are then processed directly through its detection model. For more information regarding submissions, please contact us. research@aceguardian.co。

Want to change Texas Holdem from "can understand" to "can win"?

If you want to learn more about Texas Hold'em, you can continue reading：

The Origins of Texas Hold'em: Why is it the World's Most Popular Poker Variant?
Texas Hold'em Hand Rankings and Showdown Rules (Beginner’s Essentials)
Texas Hold'em Betting teaching: Check / Bet / Call /Raise and Betting Strategy Analysis
The importance of Texas Hold'em position? Why is the back position more advantageous?
How to play Texas Hold'em? Novices learn Texas Hold'em rules, processes and betting teaching in 10 minutes
Texas Hold'em Starting Hands Strategy Guide: Which Hands to Play?
Texas Holdem Starting Hands Chart Tutorial: Complete Starting Hand Chart and Position Strategy
How to play Texas Hold'em? Complete rules and a hand's flow (Preflop / Flop / Turn / River)

Hunter Poker offers comprehensive tutorials, hand analysis, and strategy sharing to help players upgrade from simply "reading the cards" to understanding the range . This allows you to make better decisions in every hand.

▶️ In Facebook Follow Hunter Poker.
📘 In Youtube Follow Hunter Poker.

Want to learn more about Texas Hold'em gameplay and strategies?

Online Texas Hold'em free tournaments typically have no entry fee, making them ideal for beginners to familiarize themselves with the rules and for advanced players to test strategies and gain experience. View full brand profiles to learn about each platform's free tournament schedule, features, and target audience.

Go to learn more