Winning Poker Network, the operator behind ACR Poker, has introduced ScreenShield to make sensitive online poker table information harder to capture through supported external software.
The protection emerged after reports that attackers used malicious or compromised third-party tools and remote-access capabilities to see selected players’ hole cards.
Hole cards are the foundation of a fair poker game. If an opponent can see them while decisions are being made, even technically sound play becomes vulnerable. We previously examined the broader allegations in the $837K poker Trojan investigation in September 2026.
What ScreenShield actually does
With ScreenShield enabled, a player can still view and use their WPN poker tables normally. The feature prevents protected table content from appearing through certain screen-capture, screen-sharing and remote-display methods. In effect, the player sees the cards locally while a supported external capture tool is prevented from reproducing that content.
The key qualification is “certain.” This is an extra defensive layer, not proof that all remote attacks, malware or dishonest player behavior have been eliminated. Players should not treat the feature as a replacement for device security, account protection or game-integrity investigations.
What WPN says its investigation found
WPN contacted players whose devices met criteria associated with remote-access or screen-control software on September 29 and activated the protection as an additional precaution. In an October 6 official explanation, the network stated that its review had not identified a compromise of WPN systems, poker software or official downloads.
That is WPN’s account of its own systems, not an independent forensic certification of every affected device or incident. Crucially, the presence of remote-access software does not prove that a player was cheated, compromised or responsible for wrongdoing. Such software also has legitimate business, technical-support and accessibility uses.
How do players request protection?
WPN says players may request ScreenShield by contacting support@winningpokernetwork.com. Published guidance indicates activation can take up to 48 hours and that future software changes may offer more direct control over the feature.
Before requesting activation, players who stream or record sessions should ask support exactly which capture workflows will be affected. Players should also verify updates through the operator’s official channels rather than installing a purported “security patch” sent by an unknown account or download page.
Why streamers and coaches face a difficult trade-off
Poker creators use screen recording to broadcast sessions, review mistakes and teach strategy. A protection that stops malicious remote viewing may also prevent a legitimate streamer from showing their table or make session review harder. The same computer function can be harmless when authorized and dangerous when used by an attacker.
This creates a design challenge rather than a simple choice between safety and openness. If future software can permit carefully controlled output to approved applications without exposing live hole cards indiscriminately, players could retain more useful educational options. No such full solution should be assumed to exist simply because it would be desirable.
Where GTO Wizard fits into the response
WPN also says it is cooperating with GTO Wizard to examine whether relevant hands were solved during play, including work toward wider final-table checks. This is a separate initiative from blocking capture of the poker screen.
Potential real-time assistance and hole-card exposure are distinct integrity problems. RTA generally involves unauthorized strategic advice during a live hand. A hole-card attack gives an opponent information they should not possess. Detection methods and evidence requirements differ for each case.
Practical safety steps beyond ScreenShield
Players should obtain poker clients and approved utilities only from authentic sources, keep operating systems updated, review installed remote-access software and avoid sharing passwords or one-time verification codes. Using distinct passwords and multifactor authentication where supported limits some account risks, although neither measure prevents every threat from compromised software.
If suspicious behavior occurs, preserve hand histories and relevant timestamps, report the issue to the operator and avoid public accusations that identify a suspected individual without reliable evidence. PokerType’s guide to what happens after cheating is detected and analysis of open-source superuser detection explain why investigations demand more than an unusual hand.
A wider industry test
The underlying problem extends beyond ACR Poker. Similar fears can affect any room whose customers rely on third-party tracking, screen-sharing or analysis tools. An effective security response must protect players without treating everyone who uses legitimate software as suspicious.
For details on the operator’s products and policies, see PokerType’s ACR Poker review. ScreenShield represents a real technical response to a serious threat, but the important follow-up questions are how broadly it works, what evidence the investigation establishes and what legitimate activities must be sacrificed in the process.
