Between November 2025 and March 2026 the Dutch firm Eye Security pushed more than 2 million updates to computers it did not own. The goal was to switch off a background updater that could have handed an outsider control of every machine still running it.
The updater belongs to Time4Popcorn, an abandoned fork of Popcorn Time, the BitTorrent film app whose original project folded in 2014. A legal venture using the name since early 2025 is unrelated.
A dead address and 50 requests a second
Eye found Updater.exe on a client laptop trying to reach a web address nobody owned. It registered the domain to see what would connect. About 50 requests a second arrived, carrying more than 3.8 million hardware identifiers over six months.
Those identifiers proved unreliable for counting, since some Windows PCs shared one and some Macs rotated theirs. Eye settled on 2.5 to 3 million Windows machines and 250,000 to 350,000 Macs, including systems on government, military and corporate networks.
The updater started with the operating system, checked for new versions over an unencrypted connection, verified nothing about the sender, and installed whatever it received at SYSTEM on Windows and root on macOS.
Turning it against itself
Tracked as CVE-2026-30612 and rated 9.8 by CISA, the flaw exposes Windows up to 6.2.1.18, Mac up to 6.2.1.17 and Android up to 3.5.0.173. No vendor remains to patch it.
After taking legal advice, Eye served an update that stops and disables the updater – deleting no files and collecting nothing – naming the effort Operation IXIM and comparing it to the 2021 takedown of Emotet.
Antivirus engines flagged Eye’s fix as malware, so the firm reworked it until one scanner still complained. By December it had reached a million systems.
