Overview
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own, in order to switch off a background updater it said could have let an outsider take over the machine. The operation, called Operation IXIM, was presented at Hack.lu on October 22, 2026.
The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, the BitTorrent app for pirated films and TV. The original project shut down in 2014, and a separate legal project that took the Popcorn Time name in 2025 is unrelated.
The Vulnerability
Updater.exe(Windows) andPT.updd(Mac) ran in the background from startup.- They checked for new versions over an unencrypted connection and installed whatever they received, at SYSTEM (Windows) or root (Mac) privilege, without verifying the sender.
- The update servers sat at abandoned web addresses, so anyone who registered them could have pushed malicious code to every machine still calling them.
- The flaw is tracked as CVE-2026-30612 (CISA rating 9.8). It affects Windows up to 6.2.1.18, Mac up to 6.2.1.17, and Android up to 3.5.0.173.
- As of October 23, it was not in CISA's Known Exploited Vulnerabilities catalog.
How the Operation Worked
Eye registered the abandoned update domains and built a working proof of concept, but said it did not run code on user machines. It sent an update that only stopped and disabled the updater. The update deleted no files and collected no data.
Antivirus engines flagged the update as malware after it was uploaded to VirusTotal. Eye revised it until only one scanner still flagged it, because products that blocked it left the vulnerable updater running. Android was not touched, since the updater there is built into the app and installs only if the user accepts.
Scale
| Metric | Figure |
|---|---|
| Update downloads sent | 2 million+ |
| Request rate at Eye's domain | About 50 per second |
| Hardware IDs seen over six months | 3.8 million+ (judged unreliable) |
| Revised estimate | 2.5–3 million Windows machines, 250,000–350,000 Macs |
| Systems updated by December 2025 | 1 million+ (traffic down about 90%) |
| Daily updates by March 1, 2026 | About 5,000 (a 98% reduction) |
Connecting machines included home, government, military and corporate networks. Eye cautioned against drawing firm conclusions from their geographic spread.
Timeline
- Nov 2025 – Mar 2026: Eye pushes the disabling updates
- June 2026: Eye discloses the flaw
- Late March 2026: the 15 domains Eye controlled are transferred to the Shadowserver Foundation
- Oct 22, 2026: presentation at Hack.lu
Legal and Ethical Questions
Eye said it took legal advice before acting and compared the operation to the 2021 Operation Ladybird takedown of the Emotet botnet. It noted a key difference: Emotet victims never chose to be infected, whereas Popcorn Time users installed the app themselves. Eye argued that users did not choose to leave an unmaintained updater running for years. Some update domains were never Eye's to take and remain with outside owners, so machines reaching them remain exposed.
Recommendations
- Uninstall Popcorn Time. Disabling the updater leaves the rest of the app vulnerable, and it uses a 2014 browser engine with its sandbox disabled and loads content over unencrypted connections.
- If you must keep it, disable the updater manually: stop and disable the "Update service" with
sc.exeon Windows, or unload thePT.upddhelper withlaunchctlon Mac. - On Android, the only fix is to remove the app.
- Defenders should hunt for
Updater.exeandPT.upddand for traffic to the domains in Eye's write-up, which names 20.