Between November 2025 and March 2026, the Dutch security firm Eye Security executed an unprecedented cyber operation. Without owning the affected machines, the company pushed more than 2 million background software updates to millions of computers worldwide. The radical intervention was designed to switch off a dormant background updater that security researchers warned could have allowed an outsider to effortlessly seize total control of the targeted devices.
The vulnerable updater in question belongs to Time4Popcorn, an abandoned iteration of Popcorn Time—a notoriously popular application from a decade ago that allowed users to stream pirated films and television shows using BitTorrent infrastructure. While the original Popcorn Time application shut down permanently in 2014, numerous copies and forks continued to circulate online under the same recognizable moniker. Security experts note that a completely separate, legal project adopted the Popcorn Time name in early 2025, but that initiative is entirely unrelated to the legacy piracy software and its lingering security nightmares.
The discovery of the critical flaw began during a routine threat-hunting exercise conducted by Eye Security while monitoring client networks for potential intrusions. Analysts noticed that a program designated as Updater.exe, residing on a client’s laptop, repeatedly attempted to establish communication with an external web address that had long since expired and was no longer registered. Intrigued by the persistent outbound traffic, the cybersecurity firm decided to register the abandoned domain themselves to observe what kind of data and devices would attempt to connect.
The response was immediate and overwhelming. Within moments of securing the domain, roughly 50 requests per second poured into the infrastructure. Eye Security later detailed the expansive operation, officially dubbed Operation IXIM, in a comprehensive technical write-up and during a prominent presentation at the Hack.lu conference on October 22.
Over a continuous six-month observation window, those incoming requests carried more than 3.8 million distinct hardware IDs. Because these identifiers proved to be an unreliable metric for counting individual machines—owing to the fact that some Windows personal computers shared identical hardware identifiers while certain Mac devices frequently rotated theirs—Eye Security thoroughly revised its estimates. The firm ultimately concluded that the affected user base spanned between 2.5 million and 3 million Windows computers, alongside an additional 250,000 to 350,000 Mac systems.
The underlying risk stemmed from how the updater software was originally architected. It ran quietly in the background on both Windows and macOS environments from the exact moment the host computer booted up. Programmed to periodically check for new software iterations over an unencrypted network connection, the tool would blindly download and execute whatever payload it received. Crucially, it performed these operations at the highest possible privilege levels—running as the SYSTEM account on Windows and as the root user on macOS—without ever verifying the authenticity or identity of the server sending the code.
Because the command-and-control web addresses called by the updater had long been abandoned by their original creators, Eye Security realized that any malicious actor who managed to register the correct domain names could have effectively hijacked the entire network. An attacker could have served their own custom malicious programs directly to every single machine still checking in with the dead addresses.
On a machine compromised with SYSTEM or root privileges, an attacker would have near-limitless capabilities. Eye Security noted that bad actors could have easily installed destructive ransomware, systematically harvested saved browser passwords and credentials, or seamlessly conscripted millions of unsuspecting computers into a massive, global botnet. When the firm mapped a sample of the connecting IP addresses and domains, they discovered that the affected devices included standard home users distributed across the globe, as well as machines operating within sensitive government, military, and corporate networks, though researchers cautioned that it remains difficult to draw definitive conclusions from broad telemetry alone.
Eye Security formally disclosed the critical software flaw, officially tracked and cataloged as CVE-2026-30612, in June. The vulnerability has since been assigned a severity rating of 9.8 out of 10 by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), underscoring the severe systemic risk it posed to the digital ecosystem.
Turning the Updater Against Itself
With the original creators of Time4Popcorn long gone and no corporate entity left to issue an official software patch, Eye Security faced a unique dilemma. After seeking professional legal counsel, the firm decided to take matters into its own hands and weaponize the updater mechanism against itself. They engineered a benign update packet and began serving it to connecting machines. The specialized update performed only one specific action: it cleanly stopped and disabled the rogue updater service, without deleting any unrelated user files or harvesting any personal data from the host systems.
Eye Security drew comparisons between its intervention and Operation Ladybird, a coordinated international law enforcement action in 2021 where Dutch police pushed a specialized software update to computers infected with the Emotet botnet to purge the malware from within.
There was, however, a distinct philosophical difference in the eyes of the security researchers. While victims of the Emotet botnet never consciously chose to become infected with malware, users of Popcorn Time had originally installed the application of their own free will. Nevertheless, the firm emphasized that none of those users ever knowingly chose to leave a forgotten, hyper-privileged updater running silently in the background of their operating systems for years on end.
Shortly after Eye Security began distributing the neutralizing update, complications arose. An unknown party uploaded Eye’s custom update file to VirusTotal, causing automated antivirus engines to immediately flag the file as malicious. While technically accurate—in the sense that the program was designed to forcefully disable a running Windows system service—the flags created a major operational hurdle. Because every antivirus product that blocked the file also left the vulnerable Popcorn Time updater running unprotected on the host machine, Eye Security was forced to repeatedly rework and modify the update until only a single antivirus scanner continued to flag it.
By December 2025, the remediation effort had successfully updated more than 1 million individual systems, cutting inbound traffic to Eye’s controlled web domains by roughly 90 percent. By March 1 of the following year, the volume had dropped to approximately 5,000 updates a day, representing a 98 percent reduction in total active traffic. Judging that the remaining population of vulnerable machines had shrunk to a size too small to attract the interest of a serious botnet operator, Eye Security concluded the active intervention phase, having successfully delivered more than 2 million update downloads in total.
In late March, Eye Security handed over administrative control of the 15 web addresses it had registered to the Shadowserver Foundation, a respected international non-profit organization dedicated to removing abandoned and malicious domains from active circulation. This transfer ensured that trusted institutional hands would maintain stewardship over the infrastructure rather than the private security firm.
Public domain registration records for one of the key domains, popcorntimeupd[.]xyz, officially point to Shadowserver’s sinkhole servers, with ownership transfers finalized on March 20, 2026. However, the firm noted that other secondary web addresses called by the legacy updater were never within Eye’s power to acquire and remain registered by external, unrelated third parties, meaning that any lingering machines still attempting to reach those specific endpoints remain exposed.
Eye Security reported finding no concrete evidence that any malicious actors had actively exploited the addresses before the firm stepped in. The domains already registered by outside individuals were merely parked or listed for sale rather than actively distributing malicious payloads to connecting PCs.
What Popcorn Time Users Should Do
Security experts stress that successfully neutralizing the background updater does not render the underlying Popcorn Time application safe for continued use. Eye Security pointed out that the legacy application operates on an outdated browser engine originally built in 2014, with its core security sandbox mechanisms completely disabled. Furthermore, the software natively loads streaming content over unencrypted network connections and dynamically pulls in executable code from various other abandoned web addresses.
Although Eye Security registered those additional abandoned domains to prevent potential exploitation—demonstrating through a working proof of concept that they could easily execute arbitrary code on any machine running the active app—they chose not to deploy active payloads through them. Because the corrective update focused exclusively on disabling the updater service itself, the rest of the vulnerable application remains intact on user machines, presenting persistent security risks for anyone attempting to use legacy Popcorn Time software.
The definitive recommendation from security professionals is to completely uninstall Popcorn Time from all personal and professional devices. While the background updater can theoretically be disabled manually—using specific command-line instructions on Windows to stop and disable its dedicated update service, or unloading the PT.updd helper utility on macOS—completely removing the application remains the only foolproof method to eliminate residual risk.
For mobile deployments, the security landscape differs slightly. On Android-based devices, the updater functionality is deeply embedded directly into the application package and cannot be disabled independently. Because these mobile versions typically require explicit user authorization during installation, Eye Security chose not to target Android devices with remote updates. Consequently, complete uninstallation remains the sole remedy for mobile users.
Network administrators and enterprise defenders seeking to audit their internal environments for lingering traces of the vulnerability are advised to scan endpoints for the specific legacy updater binaries—namely Updater.exe on Windows systems and PT.updd on macOS—as well as inspect network telemetry for outbound connection attempts directed at the roster of abandoned domains and file hashes published in Eye Security’s official technical disclosure.
