ACR Poker says it patched a security flaw in its desktop client within an hour and found no evidence of compromised player accounts.
One player’s Microsoft Defender logs show two blocked PowerShell launch attempts on October 15 at 23:29 CEST, flagged as Trojan:Win32/Commando.A!ml, with the first traced through cmd.exe to ACRPoker.exe.
A researcher alleges a no-click table-chat exploit, but neither ACR nor the logs confirm that mechanism.
A researcher alleges a no-click table-chat exploit, but neither ACR nor the logs confirm that mechanism.
Americas Cardroom confirms patching a client security flaw. A player’s original Microsoft Defender evidence documents suspicious activity on October 15, 2026.
Americas Cardroom (ACR Poker) says it has fixed a security vulnerability in its desktop poker client after reports of suspicious activity. The acknowledgement follows warnings about possible malware delivery to players on the Winning Poker Network (WPN).
A Windows user who played on October 15 supplied original Microsoft Defender records showing two blocked PowerShell launch attempts around 11:29 p.m. Central European Summer Time. The diagnostic log links the first blocked attempt, through cmd.exe, to ACRPoker.exe. The player’s Protection History also records two severe Trojan:Win32/Commando.A!ml detections.
A cybersecurity researcher separately alleges that an exploit involving the poker client’s table chat could execute code without a player clicking anything. Neither the available Defender records nor ACR’s public statement independently establish that specific attack mechanism.
ACR Confirms a Vulnerability Was Patched
In an October update posted on its official website, ACR acknowledged a software bug that created a potential security vulnerability in its poker client. The operator says it deployed a live patch within an hour of identifying the issue and that its review found no evidence of compromised player accounts or unauthorized access to account information.
ACR has not publicly specified the bug’s technical cause, how long it was present, or whether it was the same issue described by the researcher. Its statement about account security also does not conclusively address whether any individual player computers were affected.
What the Player’s Microsoft Defender Screenshot Shows
The player’s original Windows Security screenshot shows two entries marked “Threat blocked,” both classified as severe, at 23:29 on October 15. Both identify Trojan:Win32/Commando.A!ml and display a “Removed” status. The affected item in each entry is an encoded PowerShell command.
Original Windows Security Protection History screenshot supplied by the affected player. Only the encoded command strings have been redacted; visible detection details are preserved.
The screenshot independently confirms that Microsoft Defender reported these detections. It does not, on its own, identify which application initiated them. That association appears in the separate diagnostic log.
Original Defender Logs Associate the First Attempt With ACRPoker.exe
The Microsoft Defender MPLog records the first PowerShell process creation as blocked at 21:29:46.133 UTC, equivalent to 23:29:46.133 CEST. It identifies cmd.exe (process ID 36808) as the immediate parent of that blocked PowerShell process.
In the same behavior-monitoring telemetry, process ID 36808 is identified as cmd.exe and has an ACRPoker.exe parent entry. This supports the following process association for the first blocked attempt: ACRPoker.exe → cmd.exe → powershell.exe.
The log also records a second blocked PowerShell start at 21:29:55.502 UTC, about nine seconds later. Its immediate parent process is different, and the selected records do not independently establish the same ACR parent relationship for that second attempt.
Editorially arranged excerpts from the original Microsoft Defender MPLog, with source line numbers. The executable command is omitted. This is a formatted evidence graphic, not a Windows screenshot.
The encoded command was designed to fetch and execute remote code using PowerShell. The destination referenced a temporary pinggy-free[.]link tunnel. Publishing the complete encoded command would provide little additional context, so it is excluded from both figures.
The logs support the conclusion that Defender blocked two documented PowerShell process creations. They do not prove whether a separate payload ran, whether any information was stolen, or whether other users were compromised. Follow-up quick, full and offline scans on this player’s device reportedly found no further detections.
Researcher Warns of a Possible No-Click Table-Chat Exploit
In a public warning on October 17, researcher WolfSec0x0 described an alleged flaw in WPN/ACR’s table-chat functionality that could allow attackers to run commands on another player’s computer without any click or download. The researcher said the issue had been patched and advised players to check for signs of compromise.
That description remains the researcher’s account. While ACR confirms patching a client vulnerability, its public update does not corroborate the specific table-chat mechanism or confirm that the October 15 Defender incident resulted from that flaw.
How ACR Poker Players Can Check Their PCs
Players who used the Windows client around October 15, particularly those who saw antivirus alerts, can take several practical steps:
Open Windows Security → Virus & threat protection → Protection history. Look for detections around October 15, including Trojan:Win32/Commando.A!ml.
Check available PowerShell and Windows event logs for unexpected encoded commands or unusual PowerShell launches. Historical logging may not have been enabled.
Where DNS or network logs exist, review unexpected references to pinggy-free[.]link or trycloudflare[.]com. Those services also have legitimate uses, so context matters.
Review ACR cashier activity and recent sign-ins to email and financial accounts. Investigate unrecognized password-reset messages.
Anyone who finds evidence of suspicious execution should disconnect the affected PC, secure important accounts using a different trusted device, enable available two-factor authentication and contact ACR support. A clean operating-system installation may be appropriate if a compromise cannot be ruled out.
A blocked threat alert is encouraging, but it is not absolute proof that all malicious activity was prevented. Likewise, a subsequent clean scan cannot establish with certainty that nothing happened earlier.
Is ACR Poker Safe to Play Now?
ACR says the identified vulnerability has been fixed. That reduces the risk of further exploitation through that specific flaw, assuming players use an updated client. However, patching an application would not remove malware or reverse data theft from a machine that was already compromised. Players who received suspicious alerts should investigate before relying on the computer for sensitive activities.
How This Differs From the MeshAgent Poker Scandal
The October warning comes shortly after a separate case involving compromised third-party poker utilities and MeshAgent, a remote-management tool allegedly used against high-stakes players. That episode raised fears that unauthorized observers could view players’ screens and hole cards.
WPN subsequently announced that ScreenShield would be enabled by default for all players on November 4. The feature limits certain forms of screen capture; it is not a general defense against arbitrary code execution. WPN says a review of more than two million hands associated with devices on which MeshAgent was detected found no evidence of players using opponents’ hole-card information. No public evidence establishes that the separate incidents are connected.
What Remains Unanswered
ACR has confirmed patching a client vulnerability, and an affected player’s records show suspicious PowerShell activity associated with the poker client. What is still unknown is whether the reported table-chat mechanism caused those attempts, whether any malware ran successfully on player machines, and how many users may have been exposed.
For players, the immediate priority is checking their devices and accounts. For ACR, a fuller technical explanation of the vulnerability and its impact would help establish what happened on October 15.
Vladimir is a senior iGaming writer and editor, adept at breaking down the key details of crypto casinos and sportsbooks so players don’t have to, delivering honest, player-focused information that actually matters.
