Eye Security Disables Abandoned Popcorn Time Updater on 2 Million Machines

Between November 2025 and March 2026, Dutch cybersecurity firm Eye Security executed an unprecedented neutralization campaign dubbed Operation IXIM, pushing harmless update packages to over 2 million endpoints running an abandoned fork of the Popcorn Time media streaming application. The software, known as Time4Popcorn, contained a critical remote code execution vulnerability—now tracked as CVE-2026-30612—that left millions of devices exposed to full system compromise and botnet recruitment.

The flaw carries a CVSS score of 9.8 out of 10. Left unpatched, the background updating process was primed to download and execute arbitrary code at the highest privilege levels on both Windows and macOS systems.

The Mechanics of CVE-2026-30612

The underlying vulnerability class is an insecure software update mechanism paired with hardcoded, expired domain references. The background update component—Updater.exe on Windows and PT.updd on macOS—was configured to launch automatically upon system startup. Periodically, the update service initiated outbound HTTP requests over unencrypted, cleartext connections to check for software revisions.

Crucially, the update binaries contained zero cryptographic signature verification or sender validation checks. Whatever executable payload was delivered in response to the update request was immediately written to disk and executed by the operating system with administrative privileges—SYSTEM level on Windows and root level on macOS.

+-------------------+      Cleartext HTTP Request       +------------------------+
| Endpoint Running  | --------------------------------> | Expired Domain         |
| Time4Popcorn      |                                   | (e.g. popcorntimeupd)  |
| Updater Service   | <-------------------------------- |                        |
+-------------------+    Unsigned Payload Delivered     +------------------------+
         |
         v
Executes as SYSTEM / root

When the original developers abandoned the Time4Popcorn project, they allowed the web domains used by the updater to expire. Eye Security discovered the vulnerability during a routine threat hunting engagement on a client network, observing Updater.exe repeatedly attempting to resolve a dead web address. When researchers registered the expired domain to analyze incoming traffic, they observed approximately 50 inbound requests per second from systems worldwide. Over a six-month monitoring window, the sinkholed domain recorded over 3.8 million unique hardware identifiers, representing an estimated 2.5 million to 3 million Windows endpoints and 250,000 to 350,000 macOS devices.

Because any threat actor could have registered these abandoned domains for a nominal fee, the realistic blast radius was massive. An adversary taking control of the update domains could have instantly turned millions of corporate, military, government, and consumer endpoints into a global enterprise ransomware vector or a massive distributed denial-of-service (DDoS) botnet.

Operation IXIM: Counter-Infection at Scale

Faced with an unmaintained application, no responsive software vendor, and millions of vulnerable endpoints, Eye Security took legal counsel and weaponized the update mechanism to eliminate the vulnerability. Starting in November 2025, the firm utilized the updater’s lack of authentication to serve a custom, minimal binary to connecting clients.

The custom update payload was designed with a single objective: stop and permanently disable the local Updater.exe or PT.updd service. The patch collected no telemetric data, deleted no user files, and left the main Popcorn Time streaming application untouched.

[Target Endpoint] ---> Intercepted by Eye Security Sinkhole ---> Receives Disabling Binary
                                                                          |
                                                                          v
                                                             Stops & Disables Update Service

The operation faced technical hurdles when security vendors began flagging the neutralizer update as malware. Because the update forcibly altered and disabled a running Windows service, several antivirus engines uploaded the file to VirusTotal and generated detection signatures. Because blocking the remediation payload left endpoints vulnerable to real malicious takeover, Eye Security iteratively refactored the binary until vendor false-positive alerts dropped to near zero.

By December 2025, the firm had successfully updated more than 1 million endpoints, reducing traffic to the sinkhole by 90 percent. By March 1, 2026, daily updates dropped to roughly 5,000 downloads—a 98 percent overall reduction in vulnerable active clients. Having neutralized the vast majority of the attack surface, Eye Security halted active updates after delivering over 2 million downloads.

In late March 2026, the firm transferred 15 controlled domains—including popcorntimeupd[.]xyz—to the Shadowserver Foundation to ensure long-term sinkholing and prevent domain repurchasing by threat actors.

Residual Risk and Remediation Guidance

While Operation IXIM eliminated the immediate background update threat for millions of devices, running Popcorn Time or Time4Popcorn remains a severe security risk. The primary streaming client relies on a legacy 2014 browser engine with the security sandbox completely disabled, fetches media streams over unencrypted connections, and pulls remote code from additional unmaintained infrastructure.

Disabling the background updater prevents silent machine takeover, but using the application itself still exposes endpoints to remote exploitation. Security teams and end users should immediately uninstall all variations of Popcorn Time.

Enterprise Hunting and Incident Response

Security Operations Center (SOC) teams should query endpoints and network logs for the following indicators of compromise and telemetry artifacts:

• File Artifacts: Search for active processes or disk binaries named Updater.exe (Windows) or PT.updd (macOS).
• Launch Daemon Path (macOS): /Library/LaunchDaemons/PT.updd.plist
• Network Indicators: Inspect DNS query logs for traffic attempting to resolve legacy domains such as popcorntimeupd[.]xyz.

To manually disable the updater service on endpoints where Popcorn Time cannot immediately be uninstalled:

• macOS Terminal Command: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
• Windows Command Prompt: Stop and set the startup type of the “Update service” to disabled via sc stop and sc config.

Complete removal of the application remains the only authoritative remediation step across Windows, macOS, and Android platforms.