Between November 2025 and March 2026, the Dutch security firm **Eye Security** undertook an unprecedented operation, pushing more than 2 million updates to computers it did not own. The objective: to switch off a rogue background updater associated with **Time4Popcorn**, an abandoned copy of the once-popular pirated streaming application, which posed a significant takeover risk. **Popcorn Time** gained notoriety about a decade ago for streaming pirated films and TV via BitTorrent. While the original project ceased operations in 2014, several forks continued to operate under the same name. A separate, legitimate project adopting the **Popcorn Time** name in early 2025 is unrelated to this legacy issue. ### Discovery of a Dormant Threat **Eye Security**, a firm specializing in monitoring client networks for threats, uncovered the vulnerability during a routine threat hunt. An executable named `Updater.exe` on a client's laptop was observed repeatedly attempting to connect to an unregistered web address. Recognizing the potential implications, the firm registered the defunct domain itself. Upon taking ownership of the domain, **Eye Security** witnessed a deluge of approximately 50 requests per second. This discovery prompted a deeper investigation, which the firm detailed in a [comprehensive write-up](https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/) and a [presentation at Hack.lu](https://pretalx.com/hack-lu-2026/talk/FAGXJE/) on October 22. Over six months, these requests revealed more than 3.8 million distinct hardware IDs. After refining their metrics due to inconsistencies in hardware ID reporting across different operating systems, **Eye Security** estimated the affected population to be between 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. ### The Critical Vulnerability: **CVE-2026-30612** The **Time4Popcorn** updater ran in the background on both Windows and Mac from system startup. Crucially, it checked for new versions over an unencrypted connection and installed any received payload at the highest privilege level – `SYSTEM` on Windows and `root` on Mac – without any authentication or integrity checks. This meant that anyone who registered the abandoned web addresses could have served their own malicious programs to every machine still attempting to connect. **Eye Security** warned that an attacker exploiting this access could deploy ransomware, steal saved passwords, or commandeer affected computers into a botnet. While mapping a sample of connecting IP addresses, the firm observed connections from home users globally, as well as machines on government, military, and corporate networks, though they cautioned against drawing definitive conclusions from this data.  The flaw, designated as **CVE-2026-30612**, was publicly disclosed by **Eye Security** in June. The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** rates this vulnerability with a severity score of 9.8 out of 10. It impacts specific versions of the **Time4Popcorn** software: * Windows, up to and including 6.2.1.18 * Mac, up to and including 6.2.1.17 * Android, up to and including 3.5.0.173 ### Operation IXIM: Turning the Updater Against Itself Given that the original developers had abandoned the software, leaving no avenue for an official patch, **Eye Security** devised a proactive solution. After consulting legal counsel, they decided to leverage the vulnerability itself. The firm served affected machines a custom update designed solely to stop and disable the rogue updater service, without deleting any user files or collecting personal data. **Eye Security** drew parallels to **Operation Ladybird** in 2021, where Dutch police similarly pushed an update to disable the **Emotet** botnet on infected computers. The key distinction, as **Eye Security** noted, is that **Emotet** victims were unknowingly infected, whereas **Popcorn Time** users voluntarily installed the application. However, the firm emphasized that "none of them chose to have a forgotten updater running in the background for years." Initially, the custom update triggered false positives from some antivirus engines, flagging it as malware due to its service-disabling function. **Eye Security** iteratively refined their update until only a single scanner continued to block it, ensuring maximum reach for their remediation efforts. By December 2025, **Eye Security** had successfully updated over 1 million systems, reducing traffic to their acquired web addresses by approximately 90 percent. By March 1, 2026, daily updates had dropped to around 5,000, representing a 98 percent reduction. Deeming the remaining numbers too insignificant for a botnet operator, **Eye Security** concluded its active update campaign, having delivered more than 2 million update downloads in total. In late March, **Eye Security** transferred control of the 15 web addresses it had managed to the **Shadowserver Foundation**, a non-profit organization dedicated to sinkholing abandoned and malicious domains. This ensures the domains remain under trusted stewardship. Public registration records for `popcorntimeupd[.]xyz`, for instance, now point to **Shadowserver's** sinkhole servers, with a transfer dated March 20, 2026. Other domains called by the updater were never under **Eye Security's** control and may still pose a risk. Crucially, **Eye Security** found no evidence that any other malicious actor had exploited these specific abandoned domains to serve code. The vulnerability, as of October 23, 2026, is not listed in **CISA's** catalog of known exploited vulnerabilities. ### Recommendations for **Popcorn Time** Users While disabling the updater mitigates the immediate remote code execution risk, **Eye Security** stresses that the **Time4Popcorn** application itself remains inherently insecure. It operates on an outdated 2014 browser engine with its security sandbox disabled, loads content over unencrypted connections, and pulls in code from other abandoned web addresses. **Eye Security** confirmed this risk by registering additional abandoned domains and developing a proof of concept that could execute code on machines running the app. Therefore, **Eye Security's** primary advice is to uninstall **Popcorn Time** entirely. For those unable or unwilling to uninstall immediately, the updater can be manually disabled: * **Windows:** * `sc.exe stop "Update service"` * `sc.exe config "Update service" start= disabled` * **Mac:** * `launchctl unload -w /Library/LaunchDaemons/PT.updd.plist` On Android devices, the updater is integrated into the app and cannot be independently disabled. Since installation requires user acceptance, **Eye Security** did not push updates to Android devices. For Android users, uninstalling the app is the only effective remedy. For IT security professionals seeking to identify vulnerable systems on their networks, **Eye Security** recommends scanning for the updater files (`Updater.exe` on Windows and `PT.updd` on Mac) and monitoring network traffic for connections to the web addresses listed in their detailed write-up, which includes all 20 domains and relevant file hashes.