You’re missing out on key features and a better experience. Switch now to the new interface!

For the 50,000 people who clicked “Update Now” on IDA Pro—the legendary, gold-standard disassembler used by malware analysts, government agencies, and hardcore game modders—nothing seemed amiss. The progress bar filled. The hex editor refreshed. The world kept spinning.

A collective of white-hats calling themselves launched a live disassembly of IDA Pro itself on Twitch. 200,000 viewers watched as the streamers uncovered the truth: the update had installed a lightweight, obfuscated daemon that beaconed home every 15 minutes, sending hardware IDs, a list of running processes, and—most damning—the file names of every binary ever loaded into the software.

October 23, 2026

The comment read: // TODO: Ask legal if we can sell user PC hashes to ad networks. – Steve, Q3

As for IDA Pro? It survived. It always does. But for one glorious, terrifying week in October, a boring software patch became a global parable. The hackers had been hacked. The watchers had been watched.

And somewhere, in a deleted commit log, the ghost of “Steve” chuckled—a silent, hexadecimal laugh echoing through the very tool that was meant to reveal all secrets.

// Removed the monetization module. Also, Steve says sorry.