Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine.

The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent.

Popcorn Time was popular about a decade ago, and the original shut down in 2014, but several copies kept running under the same name. A separate, legal project that took the Popcorn Time name in early 2025 is unrelated to it.

Eye Security, which monitors client networks for threats, found the updater during a routine threat hunt: a program called Updater.exe on one client's laptop kept trying to reach a web address that was no longer registered.

The firm registered the address itself to see what would connect, and about 50 requests a second poured in. It later laid out the operation, which it named Operation IXIM, in a write-up and a talk at Hack.lu on October 22.

Over six months, those requests carried more than 3.8 million different hardware IDs. The IDs proved an unreliable way to count machines, because some Windows PCs shared one and some Macs changed theirs, so Eye revised its estimate to 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs.

The updater ran in the background on Windows and Mac from the moment the computer started. It checked for new versions over an unencrypted connection and installed whatever it was sent, at the highest privilege level, called SYSTEM on Windows and root on Mac, without checking who sent it.

Because the web addresses it called had been abandoned, Eye said, anyone who registered the right one could have served their own program to every machine still calling it.

On a machine with that access, an attacker could install ransomware, steal saved passwords, or pull the computer into a botnet, Eye said. Mapping a sample of the connecting addresses, the firm said it saw home users around the world, as well as machines on government, military, and corporate networks, though it added that it is "hard to draw conclusions" from that.

Eye had disclosed the flaw, now tracked as CVE-2026-30612, in June. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. It affects three versions of the Time4Popcorn software:

  • Windows, up to and including 6.2.1.18
  • Mac, up to and including 6.2.1.17
  • Android, up to and including 3.5.0.173

Turning the Updater Against Itself

With no company left to fix the software and no patch coming, Eye decided to use the updater against itself. After taking legal advice, it served the machines an update that does one thing: it stops and disables the updater, deleting no files and collecting nothing.

Eye compared the step to Operation Ladybird in 2021, when Dutch police pushed an update to computers infected with the Emotet botnet to disable the malware on them.

The difference, Eye said, is that Emotet's victims never chose to be infected, while Popcorn Time's users installed the app themselves. Still, the firm said, "none of them chose to have a forgotten updater running in the background for years."

Soon after the updates began, someone uploaded Eye's update to VirusTotal, and antivirus engines started flagging it as malware, a fair description of a program that disables a Windows service. Because every product that blocked it left the vulnerable updater running, Eye reworked the update until only one scanner continued to flag it.

By December 2025, Eye had updated more than 1 million systems and cut the traffic to its web addresses by about 90 percent. By March 1, it was sending about 5,000 updates a day, a 98 percent reduction. Judging the remaining numbers too small to interest a botnet operator, Eye stopped, having sent more than 2 million update downloads in all.

In late March, Eye handed the 15 web addresses it controlled to the Shadowserver Foundation, a non-profit that takes abandoned and malicious domains out of circulation, so a trusted party would hold them rather than Eye.

Public registration records for one of them, popcorntimeupd[.]xyz, now point to Shadowserver's sinkhole servers, with a transfer dated March 20, 2026. Other addresses the updater calls were never Eye's to take and remain with outside owners, the firm said, so machines that reach those are still exposed.

Eye found no sign that anyone else was serving code through the addresses: the ones already registered by other people were parked or up for sale, not pushing updates to the machines calling them. The flaw is not listed in CISA's catalog of known exploited vulnerabilities as of October 23, 2026.

What Popcorn Time Users Should Do

Switching off the updater does not make the app safe. Eye said Popcorn Time runs on a 2014 browser engine with its security sandbox turned off, loads content over unencrypted connections, and pulls in code from other abandoned web addresses.

Eye registered those abandoned addresses too, which it said would have let it run its own code on every machine that opened the app. It did not, but it built a working proof of concept, so the risk is real. The update only changed the updater, so the rest of the app remains dangerous for anyone who keeps using Popcorn Time.

Eye's advice is to uninstall Popcorn Time. The updater can also be turned off by hand: on Windows with two commands that stop and disable its "Update service," and on a Mac with one that unloads the PT.updd helper. Removing the app is the safer step, because disabling the updater leaves the rest of it in place.

  • Windows: sc.exe stop "Update service"
  • Windows: sc.exe config "Update service" start= disabled
  • Mac: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist

On Android, the updater is built into the app and cannot be turned off on its own, and it installs only if the user taps to accept, so Eye did not send updates to Android devices. Removing the app is the only fix there.

To check a network, defenders can look for the two updater files, Updater.exe on Windows and PT.updd on Mac, and for traffic to the web addresses in Eye's write-up, which lists all 20 domains and the file hashes.

Update: Three of the 20 Domains Remain Outside Shadowserver's Sinkhole

A check of public registration and DNS records on October 26 found that 17 of the 20 domains in Eye's write-up now point to Shadowserver's sinkhole. Fifteen of them, popcorntimeupd[.]xyz and 14 names ending in .info, show a registry transfer dated March 20, matching the 15 that Eye handed over. Two more, popcorntime-update[.]xyz and updatepopcorntime[.]xyz, return the same sinkhole addresses.

The other three do not. One, updpopcorntime[.]xyz, uses another provider's name servers. The other two, popcorntime-upd[.]xyz and time4popcorn[.]info, use name servers at the hosting company TransIP but have no address set, so a machine that looks them up gets nothing to connect to for now. Registry records show time4popcorn[.]info was registered on October 19, three days before Eye's talk. Who holds the three could not be determined from public records.

The 14 sinkholed .info names have a separate problem. The .info registry publishes DNSSEC records for them, which let DNS services confirm that an answer is genuine, but the sinkhole's answers fail that check. Google's public DNS service, which runs the check, returns an error for all 14 instead of an address. While the records stay as they are, a machine whose DNS service runs the check cannot reach the sinkhole through those names, and it cannot be sent an update through them either. A DNS service that skips the check still returns the sinkhole's addresses. The three sinkholed .xyz names resolve normally.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.