Eye Security Disables Popcorn Time Updater in 2 Million Systems

"None of them chose to have a forgotten updater running in the background for years," Eye Security wrote — a blunt summary of a vulnerability the Dutch firm says left millions of machines able to receive and install code from abandoned web addresses.

Eye Security's routine hunt and the Updater.exe discovery

Eye Security, a Netherlands-based security firm that monitors client networks, discovered the problem during a routine threat hunt when a client's laptop showed a background program, Updater.exe, repeatedly trying to reach a web address that was no longer registered. The updater belongs to Time4Popcorn, an abandoned fork of the old Popcorn Time streaming app. Eye registered the dormant address to see what would connect and was immediately overwhelmed: about 50 requests per second arrived, carrying over 3.8 million distinct hardware IDs during the subsequent monitoring period.

CVE-2026-30612 — how the updater could be weaponized

Eye disclosed the flaw in June; it is tracked as CVE-2026-30612 and rated 9.8 out of 10 by the U.S. Cybersecurity and Infrastructure Security Agency. The updater ran from system start on Windows and Mac, checking for new versions over an unencrypted connection and installing whatever it received at the highest privilege level — SYSTEM on Windows, root on Mac — without validating the source. Eye warned that an attacker able to register the addresses the updater called could have pushed arbitrary code to affected hosts, enabling ransomware, credential theft, or enrollment in a botnet.

Operation IXIM: pushing safe updates to disable the updater

With no vendor left to patch Time4Popcorn, Eye took legal advice and launched an operation it named Operation IXIM between November 2025 and March 2026. Rather than try to fix the broken app, Eye pushed an update to machines calling the abandoned domains that does one thing: it stops and disables the updater. The update deletes no files and collects nothing. Eye likened the move to Operation Ladybird in 2021, when Dutch police disabled Emotet, but noted the distinction that Popcorn Time users installed the app themselves.

Scale, progress, and the antivirus dilemma

Counting infected machines was imprecise: hardware IDs varied by platform, so Eye revised its raw 3.8 million-ID count to an estimate of 2.5–3 million Windows computers and 250,000–350,000 Macs. By December 2025, Eye had updated more than 1 million systems and cut traffic to the domains it controlled by roughly 90 percent. By March 1, daily update delivery had fallen to about 5,000 per day — a 98 percent reduction — and Eye stopped after delivering more than 2 million update downloads total.

Soon after Eye began, someone uploaded its disabling update to VirusTotal and multiple antivirus engines flagged it as malware — an unsurprising detection for a program that disables a Windows service. Eye iterated the update until only one scanner continued to flag it; the firm said that every product that blocked the update left the vulnerable updater in place. Eye later handed the 15 web addresses it controlled to the Shadowserver Foundation so a trusted third party would sinkhole them rather than Eye.

Shadowserver handoff, remaining domains, and residual risk

Public registration records show one domain, popcorntimeupd[.]xyz, now points to Shadowserver sinkhole servers with a transfer dated March 20, 2026. Eye found no signs that third parties had been serving code on the addresses it had registered; domains already owned by others were parked or for sale. However, Eye noted some of the updater's contact addresses were never under its control and remain with outside owners; machines that call those addresses remain exposed. The vulnerability was not listed in CISA's catalog of known exploited vulnerabilities as of October 23, 2026.

What Popcorn Time users, defenders, and security teams should do

• End users: Eye's clear recommendation is to uninstall Popcorn Time. The app itself remains unsafe — it runs a 2014 browser engine with the sandbox disabled, loads content over unencrypted connections, and pulls code from abandoned addresses.
• Defenders and security teams: To look for exposure, search networks for the updater files Updater.exe (Windows) and PT.updd (Mac), and for traffic to the list of domains and file hashes Eye published in its write-up. For manual mitigation, Eye published the two Windows commands to stop and disable the service and the single Mac command to unload the helper: sc.exe stop "Update service"; sc.exe config "Update service" start= disabled; launchctl unload -w /Library/LaunchDaemons/PT.updd.plist.
• Android users: The updater is built into the app and cannot be turned off independently; it only installs if a user accepts, so Eye did not push updates to Android devices. Removing the app is the only fix on Android.

Eye Security's action removed a large portion of the immediate attack surface by converting an automatic updater into a neutralized process on millions of machines. It also exposed a hard truth: abandoned software that runs with system privileges and calls unmanaged domains can become a global distribution mechanism for malware the moment a domain lapses. Whether the remaining, still-connected machines will be reached — by researchers, defenders, or opportunistic attackers — now depends on who controls the remaining domains and whether defenders follow Eye's checklist to identify and remove the app.

Original story at The Hacker News