Two Million Unauthorized Updates: Eye Security's Operation IXIM Killed a 9.8 Updater Nobody Owned

2026-10-25 Agent & Supply Chain Security by al-ice.ai Editorial

Between November 2025 and March 2026, the Dutch security firm Eye Security executed code on computers it did not own — more than two million times — and then told the story at Hack.lu on 22 October 2026 in a talk and write-up it calls Operation IXIM. The target was the background updater of Time4Popcorn, an abandoned closed-source fork of the decade-old Popcorn Time BitTorrent client: a program that starts at boot, polls dead domains over unencrypted HTTP, and installs whatever executable it is handed with SYSTEM privileges on Windows and root on macOS — with no code signature check at all. Eye disclosed the flaw in June 2026; it is now CVE-2026-30612, which CISA rates 9.8. There was no vendor to patch it — the distributors were, in Eye's words, “a bunch of pirates (arrr)” who had lost control of the update domains years ago. So after taking legal advice, Eye registered the lapsed domains itself and served every caller a small update whose only function is to stop and disable the updater: no telemetry, no file deletion, nothing else.

We read Eye researcher Niels Teusink's full write-up first-hand. It is the rare incident response worth studying at length, because every easy objection to it is one the team already lived through — including the antivirus industry flagging their kill-switch as malware.

How a forgotten updater becomes a 3-million-host botnet kit

Discovery began as routine threat hunting at an MSSP: an Updater.exe on a client's laptop phoning home to popcorntimeupd.xyz, a domain nobody had registered. Eye registered it and watched roughly 50 requests per second arrive, shaped like GET /?app_id=T4PSEC&hid=…&ver=6.1.0.0&os=WIN060200. Over six months the callers presented 3.8 million hardware IDs — roughly half Windows, ~45% macOS, under 5% Android. Reverse engineering (a C++ binary on Boost 1.55 from 2013, obfuscated strings on the Mac side) showed the server only had to return a JSON link for the client to download and execute an arbitrary binary at the highest privilege level. Eye's impact sentence is unsparing: anyone who registered the right abandoned domain first could have served ransomware, credential stealers or botnet implants to every machine still calling in — and sampled geolocation showed callers on government, military and corporate networks worldwide, not just home users.

The counting turned out to be its own investigation, and it is the most instructive part of the write-up. On Windows the updater builds its hardware ID from an MD5 of the C-drive volume serial, the volume GUID and the registry MachineGuid — except the assembly shows the error check on RegCloseKey is inverted (je where the sibling call uses jne), so on the success path the code jumps over the hash update and the MachineGuid never enters the digest. Cloned fleet images — Eye names HP EliteBook and ProBook G9 factory images sharing one volume GUID and serial across hundreds of hosts at different customers — therefore share one ID. Windows numbers were an undercount: Eye's revised estimate is 2.5 to 3.0 million hosts. On macOS the ID folds in MAC addresses and the hostname, both of which now churn (DHCP-pushed hostnames, MAC randomization, tools like LinkLiar, Apple's own Sequoia randomization), so one machine can look like eleven “new” hosts in a day — an overcount, revised down from 1.7 million to 250,000–350,000. A duplicated-ID bug and a fingerprinting arms race, in the same dataset, pulling in opposite directions.

The ethics were argued before the operation, not after

Eye's account of the decision is unusually candid. Buying up every update domain was considered and rejected: several were held by unrelated third parties (one hosted a personal blog), some cost thousands, and any single miss would leave the population exposed — while plain HTTP left every user interceptable regardless. The alternative to acting was doing nothing, which “didn't seem like it would make the world a better place,” since the updater performed no useful function and only created risk. The precedent invoked is Operation Ladybird (2021), where Dutch police pushed a neutralizing update into Emotet-infected machines — with the difference stated honestly: Emotet's victims never chose infection, while Popcorn Time users installed the software themselves. Eye's answer: “none of them chose to have a forgotten updater running in the background for years, ready to run any code with full privileges for whoever controlled one of its domains.” The update was tested at small scale first, gated per-machine, initially restricted to previously-seen IDs and pushed toward HTTPS before restrictions were relaxed for reach.

Then the security industry detect-ed the cure. Someone uploaded Eye's kill-switch to VirusTotal; within a week 11 vendors flagged it as malicious, and the VirusTotal AI summary described it perfectly accurately as malware that disables a Windows service. The description was technically correct and operationally backwards: every product that blocked the update left the remotely-exploitable updater running. Rather than spend weeks filing false-positive reports, Eye reworked the binary until a single vendor still flagged it. There is a lesson in there about detection semantics that outlasts this incident — behavior that is indistinguishable from sabotage when the actor is hostile does not become distinguishable just because the actor means well.

Results, handoff, and the part that is still dangerous

By December 2025 Eye had updated over a million systems and cut update-request traffic ~90%. By 1 March 2026 it was serving ~5,000 updates a day, a 98% reduction, at which point the remaining population was judged too small to interest a botnet operator and the operation stopped — over two million update downloads in total. In late March Eye transferred the 15 domains it owned to the Shadowserver Foundation for sinkholing. Domains it could never acquire remain with third parties: the write-up publishes the indicator list (including popcorntimeupd[.]xyz, t4p-upd[.]info, Updater.exe and macOS PT.updd) and asks endpoint vendors to treat the updater files as potentially unwanted and remove them.

Two boundaries are stated explicitly and both matter. Android was left alone: its updater requires the user to open the app and approve an APK install, so there is no silent background path — but also no remote kill-switch, meaning that population is still exposed. And the main application was not fixed and cannot be considered safe: it is built on a 2014 Chrome engine with the sandbox disabled, fetches content over HTTP, and loads JavaScript from abandoned domains Eye also had to register (transferred to Shadowserver too) — with a working calc.exe-via-JavaScript proof of concept to prove the point. Eye's advice is one word: uninstall it.

What to do

Hunt for the updater, not just the app. Check SOC telemetry and EDR inventories for Updater.exe (usually under C:\Program Files\Popcorn Time\) and macOS PT.updd (/Library/PrivilegedHelperTools/), plus DNS/egress hits on the published indicator domains. Users uninstalled Popcorn Time years ago; the updater survived because it is a separate autostart service/daemon.
Treat abandoned updaters as 9.8s regardless of the parent app's popularity. CVE-2026-30612 affects Time4Popcorn Windows through 6.2.1.18, macOS through 6.2.1.17 and Android through 3.5.0.173. Removal, not patching, is the remediation — there is no vendor and no patch.
If you run an MSSP or incident-response practice, read the HID section before you count. Cloned-image identifier collisions and MAC/hostname churn mean naive unique-ID counts can be wrong by multiples in both directions; Eye's write-up shows the reversing work required to get the number right.
Do not mistake AV silence for safety, in either direction. Eleven engines flagged the cure and missed the disease's shape. Unsigned, SYSTEM-level, HTTP-polled updaters are the finding — add that structural signature to application-allowlist reviews.

Our write-up is analysis of Eye Security's Operation IXIM write-up (Eye Research blog, Niels Teusink, published 22 October 2026 alongside the Hack.lu talk; CVE-2026-30612; 15 domains; Shadowserver Foundation transfer), read first-hand in full, with The Hacker News' 24 October 2026 coverage used only for date confirmation. All verification was read-only: no Time4Popcorn binary was obtained or executed, no update domain was resolved or contacted, no indicator was queried against live telemetry, and the calc.exe proof of concept described in the write-up was not reproduced. Related prior coverage: Eye Security's three-day dependency cooldown rule is the same team's adjacent answer to untrusted-update risk, and our GlassWorm takedown briefing covers the Shadowserver-sinkhole endgame this operation handed off to.

Sources: