New Anti-Cheat Tool Targets Online

Online poker has a new integrity tool. Security researchers from QuintAce and AceGuardian Research have released the complete source code of an advanced anti-cheat system, freely available on GitHub, that can detect so-called superusers — players who can see their opponents' hole cards — from hand histories alone.

A Response to the Trojan Horse Scandal

The release came as a direct response to a September incident in which a Trojan horse known as MeshAgent was found in compromised versions of popular poker tools, including Jurojin Poker and IntuitiveTables. The malware allowed an attacker to view the screens and exact cards of more than two dozen high-stakes players across Europe and North America.

As the tool's creators emphasize, the poker platforms' servers themselves were not breached. The card leaks occurred directly from the victims' personal computers. Using that information at virtual tables leaves unmistakable statistical traces in game decisions, which the system can identify regardless of how the attacker obtained the data.

The project is led by Dr. Thanh Tran, founder and CEO/CTO of QuintAce and AceGuardian, a former professor of computer science at the Karlsruhe Institute of Technology and a researcher at Stanford University, alongside John Andress, head of game integrity at AceGuardian and a former high-stakes no-limit hold'em professional. The AceGuardian team has managed anti-cheating systems since 2019 for seven international platforms and evaluates tens of millions of decisions daily.

How the Tool Works: Six Key Signals

The system analyzes played hands when it has complete information on all players' cards at the table. Rather than relying on a single indicator, it combines several statistical metrics:

• Equity Comparison: A player's decisions are compared against three levels — the entire possible combination spectrum, actual opponent cards, and an estimated range from a Bayesian model. The test examines whether the player's reactions depend abnormally on the exact hidden opponent cards even after accounting for standard strategy.
• Oracle Folds: Identifies situations where a player folds a strong hand, such as top pair or two pair, that is ahead against a typical opponent range but behind against the opponent's exact hidden hand.
• Bluff Index: Tracks the frequency and success of bets with very low equity against specific opponent combinations.
• Bluff Catching: The counterpart to Bluff Index, measuring the ability to call opponents' bluffs.
• Success Rate: Analyzes results compared with players who have a similar number of hands played and a similar playstyle.
• Decision Time: Monitors the speed of action in specific situations, such as correctly folding a strong hand in a massive pot within two seconds.

The system's output does not automatically ban players. The software assigns a risk score from 0 to 100 to suspicious hands and generates a ranking for human review. An account is flagged only when multiple warning signals match across a large sample of played hands.

Case Study: Why Win Rate Alone Is Not Enough

To demonstrate the tool's effectiveness, the creators published a case study related to an incident referred to as "Paul Gregg." The analysis focused on a sample of 757 hands played over 10 weeks at 25/50 limits, mostly heads-up. The suspect won approximately $45,000 in these duels and did not experience a single losing night.

If the platform had evaluated the player solely on his bb/100 win rate, the suspect would have blended in with the crowd. His best winning streak reached the 81st percentile among 2,010 comparable players, reflecting a typical good run for a strong professional.

Only the application of the new decision model revealed a different picture. The basic model flagged 72 suspicious hands. The player ranked in the top 1% extremity across six key signals out of 193 compared heads-up players, and repeatedly exhibited extremely quick folds in spots where he was narrowly beaten, including with a hand like A-A.

Availability for Platforms and Players

Publishing the source code on GitHub under the MIT license means any online poker operator can implement the detection system into its infrastructure for free. The research team also considered the poker community itself. Players who suspect their computer has been compromised, or that they have faced opponents with illicit access to hole cards, can send their hand history directly for free analysis to research@aceguardian.co.

The code's creation marks a notable milestone for online poker security. It also sends a clear message: while attackers may find new ways to see hidden cards, statistical traces at virtual tables will eventually expose them.