2025-yil noyabridan 2026-yil martigacha Niderlandiyaning Eye Security xavfsizlik firmasi o'ziga tegishli bo'lmagan kompyuterlarga 2 milliondan ortiq yangilanish yuborib, fon rejimida ishlaydigan yangilovchini o'chirdi. Firma aytishicha, bu yangilovchi tashqi shaxsga mashinani egallab olish imkonini berishi mumkin edi.
Yangilovchi Time4Popcorn — Popcorn Time-ning tashlab ketilgan nusxasi — bepul ilovaga tegishli bo'lib, u BitTorrent orqali pirat filmlar va teleko'rsatuvlarni oqimga uzatardi.
Popcorn Time taxminan o'n yil oldin mashhur edi va asl nusxa 2014-yilda yopilgan, ammo bir nechta nusxalar xuddi shu nom ostida ishlashda davom etgan. 2025-yil boshida Popcorn Time nomini olgan alohida, qonuniy loyiha bu bilan bog'liq emas.
Mijoz tarmoqlarida tahdidlarni kuzatuvchi Eye Security, odatiy tahdid ovlash jarayonida yangilovchini topdi: mijozning noutbukidagi Updater.exe nomli dastur endi ro'yxatdan o'tmagan veb-manzilga murojaat qilishga urinardi.
Firma manzilni o'zi ro'yxatdan o'tkazib, nima ulanishini ko'rdi va har soniyada taxminan 50 ta so'rov kelib tushdi. Keyinchalik u operatsiyani, uni Operation IXIM deb nomlab, yozma hisobot va 22-oktabrdagi Hack.lu konferensiyasidagi nutqda bayon qildi.
Olti oy davomida bu so'rovlar 3,8 milliondan ortiq turli apparat identifikatorlarini olib keldi. Bu identifikatorlar mashinalarni sanashda ishonchsiz usul bo'lib chiqdi, chunki ba'zi Windows kompyuterlari bir xil identifikatorni ishlatardi, ba'zi Mac kompyuterlari esa o'zgarardi. Shuning uchun Eye o'z bahosini 2,5 dan 3 milliongacha Windows kompyuterlari va 250 000 dan 350 000 gacha Mac kompyuterlari deb qayta ko'rib chiqdi.
Yangilovchi kompyuter ishga tushgan paytdan boshlab Windows va Mac-da fon rejimida ishlardi. U shifrlanmagan ulanish orqali yangi versiyalarni tekshirar va yuborilgan har qanday narsani, yuboruvchini tekshirmasdan, eng yuqori imtiyoz darajasida — Windows-da SYSTEM, Mac-da root — o'rnatar edi.
U murojaat qilgan veb-manzillar tashlab ketilganligi sababli, Eye aytishicha, to'g'ri manzilni ro'yxatdan o'tkazgan har kim o'z dasturini hali ham murojaat qilayotgan har bir mashinaga yuborishi mumkin edi.
Bunday kirish huquqiga ega mashinada hujumchi to'lov dasturini (ransomware) o'rnatishi, saqlangan parollarni o'g'irlashi yoki kompyuterni botnetga qo'shishi mumkin edi, deb aytdi Eye. Ulanish manzillarining namunasini xaritalab, firma butun dunyo bo'ylab uy foydalanuvchilarini, shuningdek, hukumat, harbiy va korporativ tarmoqlardagi mashinalarni ko'rganini aytdi, ammo "bu ma'lumotlardan xulosa chiqarish qiyin" deb qo'shib qo'ydi.
Eye iyun oyida CVE-2026-30612 deb kuzatiladigan zaiflikni oshkor qilgan. AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) uni 10 dan 9,8 deb baholaydi. U Time4Popcorn dasturining uchta versiyasiga ta'sir qiladi:
- Windows, 6.2.1.18 va undan oldingi versiyalar
- Mac, 6.2.1.17 va undan oldingi versiyalar
- Android, 3.5.0.173 va undan oldingi versiyalar
Yangilovchini O'ziga Qarshi Ishlatish
Dasturiy ta'minotni tuzatadigan kompaniya qolmagan va yangilanish kutilmagani sababli, Eye yangilovchini o'ziga qarshi ishlatishga qaror qildi. Huquqiy maslahat olgach, u mashinalarga faqat bitta ishni bajaradigan yangilanish yubordi: u yangilovchini to'xtatadi va o'chiradi, hech qanday faylni o'chirmaydi va hech narsa yig'maydi.
Eye bu qadamni 2021-yildagi Operation Ladybird bilan taqqosladi, o'shanda Niderlandiya politsiyasi Emotet botneti bilan zararlangan kompyuterlarga yangilanish yuborib, zararli dasturiy ta'minotni o'chirgan edi.
Farqi shundaki, Eye aytishicha, Emotet qurbonlari hech qachon zararlanishni tanlamagan, Popcorn Time foydalanuvchilari esa ilovani o'zlari o'rnatgan. Shunga qaramay, firma aytdiki, "ularning hech biri yillar davomida unutilgan yangilovchining fon rejimida ishlashini tanlamagan".
Yangilanishlar boshlangandan ko'p o'tmay, kimdir Eye'ning yangilanishini VirusTotal'ga yukladi va antivirus dvigatellari uni zararli dastur sifatida belgilay boshladi — bu Windows xizmatini o'chiradigan dastur uchun adolatli tavsif. Uni bloklagan har bir mahsulot zaif yangilovchini ishlashda qoldirgani sababli, Eye yangilanishni qayta ishladi va faqat bitta skaner uni belgilashda davom etdi.
2025-yil dekabriga kelib, Eye 1 milliondan ortiq tizimni yangilagan va o'z veb-manzillariga keladigan trafikni taxminan 90 foizga kamaytirgan. 1-martga kelib, u kuniga taxminan 5 000 ta yangilanish yuborardi — bu 98 foizlik pasayish. Qolgan raqamlar botnet operatorini qiziqtirmasligini hisoblab, Eye to'xtadi va jami 2 milliondan ortiq yangilanish yuklab olishni yuborgan.
Mart oyining oxirida Eye o'zi nazorat qilgan 15 ta veb-manzilni Shadowserver Foundation — tashlab ketilgan va zararli domenlarni aylanishdan chiqaradigan notijorat tashkilotga topshirdi, shunda ishonchli tomon ularni Eye emas, balki o'zi saqlaydi.
Ulardan biri — popcorntimeupd[.]xyz — uchun ommaviy ro'yxatga olish yozuvlari endi Shadowserver'ning sinkhole serverlariga ishora qiladi, 2026-yil 20-mart sanasi bilan o'tkazish qayd etilgan. Yangilovchi murojaat qiladigan boshqa manzillar hech qachon Eye'ga tegishli bo'lmagan va tashqi egalarda qolgan, shuning uchun ularga yetadigan mashinalar hali ham ochiq qolgan, deb aytdi firma.
Eye manzillar orqali boshqa hech kim kod yubormaganini topmadi: boshqa shaxslar tomonidan ro'yxatdan o'tkazilganlar to'xtatilgan yoki sotuvga qo'yilgan, mashinalarga yangilanish yubormagan. Zaiflik 2026-yil 23-oktabr holatiga ko'ra CISA'ning ma'lum ekspluatatsiya qilingan zaifliklar katalogida ro'yxatga olinmagan.
Popcorn Time Foydalanuvchilari Nima Qilishi Kerak
Yangilovchini o'chirish ilovani xavfsiz qilmaydi. Eye aytishicha, Popcorn Time 2014-yilgi brauzer dvigatelida ishlaydi, uning xavfsizlik sandbox'i o'chirilgan, kontentni shifrlanmagan ulanishlar orqali yuklaydi va boshqa tashlab ketilgan veb-manzillardan kod oladi.
Eye bu tashlab ketilgan manzillarni ham ro'yxatdan o'tkazgan va bu unga ilovani ochgan har bir mashinada o'z kodini ishga tushirish imkonini berardi, deb aytdi. U buni qilmagan, ammo ishlaydigan isbot-konsepsiya (proof of concept) yaratgan, shuning uchun xavf haqiqiy. Yangilanish faqat yangilovchini o'zgartirgan, shuning uchun ilovaning qolgan qismi Popcorn Time'dan foydalanishda davom etadigan har kim uchun xavfli qoladi.
Eye'ning maslahati — Popcorn Time'ni o'chirish. Yangilovchini qo'lda ham o'chirish mumkin: Windows-da "Update service"ni to'xtatadigan va o'chiradigan ikkita buyruq bilan, Mac-da esa PT.updd yordamchisini yukdan tushiradigan bitta buyruq bilan. Ilovani o'chirish xavfsizroq qadam, chunki yangilovchini o'chirish uning qolgan qismini joyida qoldiradi.
- Windows: sc.exe stop "Update service"
- Windows: sc.exe config "Update service" start= disabled
- Mac: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
Android-da yangilovchi ilova ichiga o'rnatilgan va o'z-o'zidan o'chirilmaydi, u faqat foydalanuvchi qabul qilishni bosganda o'rnatiladi, shuning uchun Eye Android qurilmalariga yangilanish yubormagan. U yerda yagona tuzatish — ilovani o'chirish.
Tarmoqni tekshirish uchun himoyachilar ikkita yangilovchi faylni — Windows-da Updater.exe va Mac-da PT.updd — va Eye'ning yozma hisobotida keltirilgan veb-manzillarga trafikni qidirishlari mumkin, u yerda 20 ta domen va fayl xeshlari ro'yxatga olingan.
Yangilanish: 20 ta Domenning Uchtasi Shadowserver Sinkhole'idan Tashqarida Qolgan
2026-yil 26-oktabrda ommaviy ro'yxatga olish va DNS yozuvlarini tekshirish shuni ko'rsatdiki, Eye'ning yozma hisobotidagi 20 ta domenning 17 tasi endi Shadowserver'ning sinkhole'iga ishora qiladi. Ulardan 15 tasi — popcorntimeupd[.]xyz va .info bilan tugaydigan 14 ta nom — 20-mart sanasi bilan ro'yxatga olish o'tkazishini ko'rsatadi, bu Eye topshirgan 15 ta domen bilan mos keladi. Yana ikkitasi — popcorntime-update[.]xyz va updatepopcorntime[.]xyz — xuddi shu sinkhole manzillarini qaytaradi.
Qolgan uchtasi bunday emas. Biri — updpopcorntime[.]xyz — boshqa provayderning nom serverlaridan foydalanadi. Qolgan ikkitasi — popcorntime-upd[.]xyz va time4popcorn[.]info — hosting kompaniyasi TransIP'dagi nom serverlaridan foydalanadi, ammo hech qanday manzil o'rnatilmagan, shuning uchun hozircha ularga murojaat qilgan mashina ulanish uchun hech narsa topmaydi. Ro'yxatga olish yozuvlari time4popcorn[.]info 19-oktabrda, Eye'ning nutqidan uch kun oldin ro'yxatdan o'tkazilganini ko'rsatadi. Uchta domenning egasi kimligi ommaviy yozuvlardan aniqlanmadi.
Sinkhole'ga yo'naltirilgan 14 ta .info nomi alohida muammoga ega. .info registri ular uchun DNSSEC yozuvlarini e'lon qiladi, bu DNS xizmatlariga javob haqiqiy ekanligini tasdiqlash imkonini beradi, ammo sinkhole javoblari bu tekshiruvdan o'tmaydi. Tekshiruvni amalga oshiradigan Google'ning ommaviy DNS xizmati 14 ta domenning barchasi uchun manzil o'rniga xato qaytaradi. Bu yozuvlar o'zgarmaguncha, DNS xizmati tekshiruvni amalga oshiradigan mashina bu nomlar orqali sinkhole'ga yetib borolmaydi va ular orqali yangilanish yuborilmaydi. Tekshiruvni o'tkazib yuboradigan DNS xizmati hali ham sinkhole manzillarini qaytaradi. Uchta sinkhole'ga yo'naltirilgan .xyz nomlari odatiy tarzda hal qilinadi.
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine.
The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent.
Popcorn Time was popular about a decade ago, and the original shut down in 2014, but several copies kept running under the same name. A separate, legal project that took the Popcorn Time name in early 2025 is unrelated to it.
Eye Security, which monitors client networks for threats, found the updater during a routine threat hunt: a program called Updater.exe on one client's laptop kept trying to reach a web address that was no longer registered.
The firm registered the address itself to see what would connect, and about 50 requests a second poured in. It later laid out the operation, which it named Operation IXIM, in a write-up and a talk at Hack.lu on October 22.
Over six months, those requests carried more than 3.8 million different hardware IDs. The IDs proved an unreliable way to count machines, because some Windows PCs shared one and some Macs changed theirs, so Eye revised its estimate to 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs.
The updater ran in the background on Windows and Mac from the moment the computer started. It checked for new versions over an unencrypted connection and installed whatever it was sent, at the highest privilege level, called SYSTEM on Windows and root on Mac, without checking who sent it.
Because the web addresses it called had been abandoned, Eye said, anyone who registered the right one could have served their own program to every machine still calling it.
On a machine with that access, an attacker could install ransomware, steal saved passwords, or pull the computer into a botnet, Eye said. Mapping a sample of the connecting addresses, the firm said it saw home users around the world, as well as machines on government, military, and corporate networks, though it added that it is "hard to draw conclusions" from that.
Eye had disclosed the flaw, now tracked as CVE-2026-30612, in June. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. It affects three versions of the Time4Popcorn software:
- Windows, up to and including 6.2.1.18
- Mac, up to and including 6.2.1.17
- Android, up to and including 3.5.0.173
Turning the Updater Against Itself
With no company left to fix the software and no patch coming, Eye decided to use the updater against itself. After taking legal advice, it served the machines an update that does one thing: it stops and disables the updater, deleting no files and collecting nothing.
Eye compared the step to Operation Ladybird in 2021, when Dutch police pushed an update to computers infected with the Emotet botnet to disable the malware on them.
The difference, Eye said, is that Emotet's victims never chose to be infected, while Popcorn Time's users installed the app themselves. Still, the firm said, "none of them chose to have a forgotten updater running in the background for years."
Soon after the updates began, someone uploaded Eye's update to VirusTotal, and antivirus engines started flagging it as malware, a fair description of a program that disables a Windows service. Because every product that blocked it left the vulnerable updater running, Eye reworked the update until only one scanner continued to flag it.
By December 2025, Eye had updated more than 1 million systems and cut the traffic to its web addresses by about 90 percent. By March 1, it was sending about 5,000 updates a day, a 98 percent reduction. Judging the remaining numbers too small to interest a botnet operator, Eye stopped, having sent more than 2 million update downloads in all.
In late March, Eye handed the 15 web addresses it controlled to the Shadowserver Foundation, a non-profit that takes abandoned and malicious domains out of circulation, so a trusted party would hold them rather than Eye.
Public registration records for one of them, popcorntimeupd[.]xyz, now point to Shadowserver's sinkhole servers, with a transfer dated March 20, 2026. Other addresses the updater calls were never Eye's to take and remain with outside owners, the firm said, so machines that reach those are still exposed.
Eye found no sign that anyone else was serving code through the addresses: the ones already registered by other people were parked or up for sale, not pushing updates to the machines calling them. The flaw is not listed in CISA's catalog of known exploited vulnerabilities as of October 23, 2026.
What Popcorn Time Users Should Do
Switching off the updater does not make the app safe. Eye said Popcorn Time runs on a 2014 browser engine with its security sandbox turned off, loads content over unencrypted connections, and pulls in code from other abandoned web addresses.
Eye registered those abandoned addresses too, which it said would have let it run its own code on every machine that opened the app. It did not, but it built a working proof of concept, so the risk is real. The update only changed the updater, so the rest of the app remains dangerous for anyone who keeps using Popcorn Time.
Eye's advice is to uninstall Popcorn Time. The updater can also be turned off by hand: on Windows with two commands that stop and disable its "Update service," and on a Mac with one that unloads the PT.updd helper. Removing the app is the safer step, because disabling the updater leaves the rest of it in place.
- Windows: sc.exe stop "Update service"
- Windows: sc.exe config "Update service" start= disabled
- Mac: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
On Android, the updater is built into the app and cannot be turned off on its own, and it installs only if the user taps to accept, so Eye did not send updates to Android devices. Removing the app is the only fix there.
To check a network, defenders can look for the two updater files, Updater.exe on Windows and PT.updd on Mac, and for traffic to the web addresses in Eye's write-up, which lists all 20 domains and the file hashes.
Update: Three of the 20 Domains Remain Outside Shadowserver's Sinkhole
A check of public registration and DNS records on October 26 found that 17 of the 20 domains in Eye's write-up now point to Shadowserver's sinkhole. Fifteen of them, popcorntimeupd[.]xyz and 14 names ending in .info, show a registry transfer dated March 20, matching the 15 that Eye handed over. Two more, popcorntime-update[.]xyz and updatepopcorntime[.]xyz, return the same sinkhole addresses.
The other three do not. One, updpopcorntime[.]xyz, uses another provider's name servers. The other two, popcorntime-upd[.]xyz and time4popcorn[.]info, use name servers at the hosting company TransIP but have no address set, so a machine that looks them up gets nothing to connect to for now. Registry records show time4popcorn[.]info was registered on October 19, three days before Eye's talk. Who holds the three could not be determined from public records.
The 14 sinkholed .info names have a separate problem. The .info registry publishes DNSSEC records for them, which let DNS services confirm that an answer is genuine, but the sinkhole's answers fail that check. Google's public DNS service, which runs the check, returns an error for all 14 instead of an address. While the records stay as they are, a machine whose DNS service runs the check cannot reach the sinkhole through those names, and it cannot be sent an update through them either. A DNS service that skips the check still returns the sinkhole's addresses. The three sinkholed .xyz names resolve normally.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.