Operation IXIM remotely neutralises two million Popcorn Time updaters

Operation IXIM remotely disarms two million vulnerable Popcorn Time zombie updaters across global networks

In one of the largest coordinated active defence interventions in recent cybersecurity history, Dutch security firm Eye Security and the Shadowserver Foundation executed Operation IXIM, safely neutralising over two million vulnerable endpoints running abandoned installations of Time4Popcorn, a defunct closed-source fork of the Popcorn Time BitTorrent streaming application. Disclosed at the Hack.lu conference in October 2026, the operation defused an acute global remote code execution crisis tracked as CVE-2026-30612, which exposed millions of consumer and corporate devices to unauthenticated takeover with absolute system privileges.

The underlying vulnerability stems from an insecure background updater shipped within Time4Popcorn that executed as NT AUTHORITY\SYSTEM on Windows and as root via a launch daemon on macOS. The software polled an unencrypted HTTP domain for software updates without validating digital code signatures. When the software creators abandoned the project and allowed their update domains to expire, any malicious actor could have registered the domain for a nominal registration fee and instantly commanded a botnet of between 2.75 million and 3.35 million high-privilege endpoints. Between November 2025 and March 2026, Eye Security registered the lapsed domains, intercepted 50 requests per second (amounting to 4,320,000 requests per day, derived), and delivered a benign neutralizing update that disabled the update service without damaging user files or collecting private telemetry.

Technical execution architecture of the Operation IXIM remote neutralisation chain

Zoom

Quantitative telemetry and computed operational impact

Analysis of the sinkhole traffic logs and payload deployment records establishes the unprecedented scale of the dormant zombie updater population:

Quantitative operational telemetry and derived remediation metrics for Operation IXIM

Operational Metric	Recorded Telemetry	Strategic Significance
Estimated Vulnerable Population	2,750,000 to 3,350,000 devices	Comprising 2.5M to 3.0M Windows machines and 250k to 350k macOS endpoints (midpoint: 3,050,000).
Neutralising Payloads Delivered	Over 2,000,000 devices	Achieved between 59.7% and 72.7% neutralised coverage (midpoint 65.6%, derived) across the active fleet.
Sinkhole Query Volume	50 requests per second	Translating to 4,320,000 incoming update checks per day (derived) directed to expired infrastructure.
Operational Duration	November 2025 to March 2026	A five-month targeted campaign preceding formal transfer to the Shadowserver Foundation.
Query Traffic Reduction	98.0 percent collapse	Only 2.0 percent residual traffic remained active (derived) following broad automated service neutralisation.
Execution Privilege Context	SYSTEM (Windows) / root (macOS)	Maximum operating system privilege levels executed without user confirmation or security prompts.
Vulnerability Tracking ID	CVE-2026-30612	CWE-494: Download of Code Without Integrity Check in unmaintained consumer application.

Epistemic audit of confirmed research findings versus unstated operational factors

To maintain analytical objectivity, the following matrix contrasts facts verified through primary conference disclosures and technical whitepapers against operational details that remain unstated or unverified.

Epistemic matrix comparing confirmed technical disclosures against unstated operational factors

Analytical Dimension	Explicitly Confirmed in Research Disclosures	Unstated or Operationally Unresolved
Discovery Trigger	Observed during a routine threat hunting engagement on a corporate client laptop contacting popcorntimeupd.xyz.	The corporate identity or industry vertical of the initial client where the abandoned updater was first identified.
Update Delivery Protocol	Plaintext HTTP requests with zero cryptographic signature verification or hash validation.	Whether any cybercriminal threat actors attempted to register the expired domains prior to Eye Security.
Payload Action Scope	Cleanly stops Windows Update service and unloads macOS launch daemon; logs zero client IP addresses or personal data.	The proportion of home consumer machines versus enterprise managed endpoints among the two million patched devices.
Antivirus Interactions	Commercial security products and heuristic AI filters falsely flagged the benign disabler binary as a Trojan or Cobalt Strike beacon.	The complete list of specific antivirus vendors whose automated detections blocked early iterations of the neutraliser.
Permanent Infrastructure Status	Domains formally transferred to the Shadowserver Foundation for ongoing passive sinkholing and threat observation.	The total annual infrastructure and DNS renewal cost absorbed by non-profit foundations to maintain the sinkhole.

The friendly-name fallacy: How background convenience breeds high-privilege zombies

In modern software development, the automatic background updater is universally hailed as an indispensable security feature. Industry best practices dictate that software should update silently to protect users from newly discovered vulnerabilities without requiring manual user intervention. However, Operation IXIM reveals how this benign concept becomes a catastrophic liability when applied to closed-source, unmaintained software. Branded innocuously as an Update service, the component operated not as a guardian of software integrity, but as an unauthenticated backdoor permanently listening for instructions from whoever controlled a public domain name.

Users who installed Time4Popcorn in 2015 or 2018 frequently forgot that the software existed after watching a single film, or believed that closing the desktop application terminated all associated processes. In reality, the installer registered a permanent system service on Windows and a launch daemon on macOS that persisted across system reboots for nearly a decade. By treating the presence of an update service as inherently benign, endpoint administrators and consumer users alike ignored the fundamental reality that an unauthenticated updater is functionally indistinguishable from pre-installed malware waiting for a command.

Technical forensic autopsy across five operational phases

Phase 1: Architectural Anatomy of the Time4Popcorn Updater

Time4Popcorn differed significantly from the original open-source Popcorn Time project. While the legitimate open-source community maintained transparency, Time4Popcorn was distributed as a proprietary, closed-source fork that bundled non-standard background components. Chief among these was a standalone updater binary, installed on Windows hosts as Updater.exe and configured as a Windows Service named simply Update service, configured with automatic startup under the NT AUTHORITY\SYSTEM security descriptor.

On macOS systems, the installation package wrote a launch daemon configuration plist to /Library/LaunchDaemons/ referencing a background executable named PT.updd. Because launch daemons on macOS execute outside of the user session, PT.updd possessed root privileges. On both platforms, these services executed autonomously in the background, operating completely independently of whether the graphical media player interface was open, closed, or had been removed from the user desktop.

Phase 2: Insecure Protocol and Missing Signature Verification (CVE-2026-30612)

The architectural flaw tracked as CVE-2026-30612 represents a textbook failure of secure software design (CWE-494). At regular periodic intervals, the background updater initiated outbound HTTP GET requests to check for new releases. The target endpoint was hardcoded as an unencrypted HTTP URL pointing to popcorntimeupd.xyz.

Crucially, the update client implemented zero cryptographic integrity checks. The client did not use Transport Layer Security (TLS), preventing mutual authentication and exposing requests to local network spoofing. Worse, upon receiving an HTTP 200 response containing a binary download URL, the updater downloaded the file directly to a temporary directory and invoked the operating system execution API (such as CreateProcess on Windows or execve on macOS) without verifying Authenticode code signatures, checking cryptographic hashes, or prompting the user for approval. Any executable returned by the server was immediately executed with full system privileges.

Phase 3: The Expired Domain Catastrophe

When the anonymous operators behind Time4Popcorn abandoned the project, they ceased paying annual domain registration fees. The domain popcorntimeupd.xyz eventually lapsed and returned to the public domain registry pool. This created an extraordinary systemic vulnerability. Any individual, cybercrime syndicate, or hostile intelligence agency could have purchased the expired domain for less than fifteen dollars.

Had an adversary acquired the domain before security researchers, they would have inherited immediate, unauthenticated remote command execution across millions of devices globally. Because the updater sent 50 requests per second (4.32 million daily queries, derived), a threat actor serving a malicious ransomware payload or information stealer could have infected over two million endpoints within hours, turning the dormant fleet into one of the largest corporate and consumer botnets in history.

Phase 4: Operation IXIM Sinkhole and the Benign Vaccine

Recognising the acute danger during a customer incident investigation, Dutch security firm Eye Security registered the expired update domain in November 2025 to prevent adversary acquisition. Upon standing up a passive monitoring server, researchers observed an immediate deluge of millions of unique client connections. Rather than merely monitoring the threat, researchers initiated Operation IXIM, deciding to safely disarm the vulnerable fleet.

To achieve this without compromising user privacy or violating ethical boundaries, Eye Security engineered a benign neutraliser binary. The payload was designed with three strict constraints: it collected zero telemetry or IP logs, it made no modifications to user media files or application preferences, and its sole function was to cleanly terminate and disable the background update mechanism. On Windows, the binary invoked the Service Control Manager to stop the Update service and set its startup type to disabled, removing associated registry Run keys. On macOS, the payload executed launchctl unload to terminate PT.updd and removed the plist file from the LaunchDaemons directory. Between November 2025 and March 2026, over two million vulnerable endpoints downloaded and executed the vaccine.

Phase 5: Antivirus False Positives and Shadowserver Handover

The execution of Operation IXIM encountered significant operational friction from automated endpoint detection tools. Because Eye Security's neutralising binary was an unsigned, newly compiled executable that modified operating system services and registry run keys from a remote download, commercial antivirus software and machine learning heuristic engines frequently flagged it as malicious. Several automated sandbox analysers classified the benign disabler as a Cobalt Strike beacon or a Trojan stealer, actively blocking users from receiving the fix.

Researchers engaged with security vendors and adjusted payload compilation routines to bypass heuristic false positives, ensuring that endpoint security software did not inadvertently preserve the vulnerability by blocking its cure. By March 2026, the volume of incoming update requests to the sinkhole had collapsed by 98.0 percent, indicating that the vast majority of the active fleet had been successfully disarmed. Eye Security subsequently transferred ownership of all registered update domains to the Shadowserver Foundation for permanent sinkholing and ongoing threat telemetry monitoring.

UK regulatory compliance, legal dilemmas, and NCSC guidance alignment

Operation IXIM highlights complex legal, ethical, and regulatory questions for organisations and cybersecurity practitioners operating under United Kingdom jurisdiction.

Under the UK Computer Misuse Act 1990 (CMA), Section 3 criminalises any unauthorised act with intent to impair, or with recklessness as to impairing, the operation of a computer. While Eye Security operated under the Dutch legal framework for Coordinated Vulnerability Disclosure and duty of care, pushing executable code to foreign endpoints without prior explicit consent from device owners occupies a highly contentious legal territory in the UK. Even though the payload was demonstrably benign and prevented catastrophic harm, UK legal scholars and law enforcement agencies have historically noted that Section 3 contains no explicit statutory public interest defence for white-hat active defence or remote remediation. This tension continues to fuel calls for CMA reform to provide legal safe harbours for defensive cybersecurity interventions.

From an enterprise governance perspective, the National Cyber Security Centre (NCSC) addresses this scenario within its Supply Chain Security Guidance and Asset Management guidelines. The NCSC highlights shadow software as a premier vector for enterprise compromise. In numerous documented instances, corporate laptops taken home by remote employees were used to install unapproved personal software such as Popcorn Time. Even after employees ceased using the application, the background service remained on corporate hardware, exposing enterprise networks to potential compromise. The NCSC advises organisations to enforce strict application allowlisting, implement continuous endpoint software inventory tracking, and block network access to expired or unclassified domain categories.

Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, organisations whose corporate devices harboured vulnerable Time4Popcorn updaters faced potential compliance violations regarding Article 32 (Security of Processing). Deploying corporate hardware with unmonitored background services running as SYSTEM that execute arbitrary unencrypted web code represents a clear failure to implement appropriate technical measures to prevent unauthorised access to enterprise data.

Defensive checklist for enterprise IT and managed service providers

Enterprise security teams must execute the following remediation protocol to ensure no residual zombie updaters remain active across their managed fleets:

1. Audit Windows Service Registrations: Execute a fleet-wide query across all managed Windows endpoints using PowerShell or EDR to check for the presence of a service named Update service pointing to Updater.exe in user app data directories. Terminate and delete any identified services using sc.exe delete.

2. Inspect macOS Launch Daemons: Audit all macOS endpoints for the presence of /Library/LaunchDaemons/ referencing PT.updd. Execute launchctl bootout system /Library/LaunchDaemons/com.time4popcorn.updd.plist and remove the associated binary and property list.

3. Review Firewall and DNS Sinkholes: Verify that internal DNS servers and secure web gateways block or sinkhole legacy update domains, including popcorntimeupd.xyz and associated variants, ensuring that any unpatched devices cannot communicate with unregistered infrastructure.

4. Enforce Application Allowlisting: Implement strict AppLocker or Windows Defender Application Control (WDAC) policies preventing standard users from executing software from local AppData or temporary directories, preventing the installation of unapproved shadow software.

5. Conduct Stale Software Sweeps: Deploy automated vulnerability management scanners to flag software packages that have not received vendor updates in over 24 months, initiating automated uninstallation routines for abandoned software across all corporate endpoints.

The exposing question for cybersecurity leaders

If your organisation relies on automated endpoint detection tools to safeguard corporate data, how many unmonitored shadow software update services are currently running with SYSTEM privileges on your remote laptops, waiting for an expired fifteen-dollar domain to be purchased by an adversary?

Key operational facts

Essential technical and operational parameters for Operation IXIM

Operational Parameter	Verified Technical Detail
Operation Codename	Operation IXIM
Primary Investigating Entity	Eye Security (led by researcher Niels Teusink)
Infrastructure Stewardship Partner	The Shadowserver Foundation
Vulnerability Identifier	CVE-2026-30612
Weakness Classification	CWE-494: Download of Code Without Integrity Check
Target Application	Time4Popcorn (closed-source abandoned fork of Popcorn Time)
Vulnerable Components	Updater.exe (Windows service as SYSTEM) and PT.updd (macOS daemon as root)
Interception Mechanism	Sinkholing of expired update domain popcorntimeupd.xyz
Total Estimated Population	2,750,000 to 3,350,000 devices (midpoint: 3,050,000)
Neutralising Payloads Served	Over 2,000,000 devices (59.7% to 72.7% fleet coverage, derived)
Observed Traffic Drop	98.0 percent reduction by March 2026
Public Disclosure Venue	Hack.lu Conference, October 2026