Popcorn Time updater flaw exposed millions of devices to hijacking

Eye Research delivered more than two million update downloads in an operation to disable an abandoned Popcorn Time updater that could have allowed attackers to hijack Windows and macOS systems with full privileges.

The vulnerability, tracked as CVE-2026-30612, affected the Time4Popcorn fork. Its update mechanism trusted unsigned executables delivered over unencrypted HTTP, including through domains that had expired and become available for registration.

Researcher Niels Teusink detailed “Operation IXIM,” conducted between November 2025 and March 2026. The investigation began when Eye spotted an Updater.exe process on a customer’s laptop contacting the unregistered domain popcorntimeupd.xyz.

Time4Popcorn was a closed-source fork of Popcorn Time, the once-popular BitTorrent streaming application. Several forks shared the Popcorn Time name, making them difficult to distinguish. Eye says its findings do not apply to the newer project launched under that name in early 2025.

Abandoned domains, privileged access

After registering the domain, Eye received approximately 50 requests per second. Over six months, it recorded more than 3.8 million distinct identifiers, although further investigation showed these could not reliably represent individual devices.

Reverse engineering revealed that Windows clients would accept a JSON response pointing to an executable, download it, and run it as NT AUTHORITY\SYSTEM. The macOS updater similarly allowed execution as root. Neither mechanism verified code signatures.

Both updaters started automatically, leaving systems exposed even after owners stopped using the application years earlier. Attackers controlling an update domain, or able to manipulate the unencrypted traffic, could potentially distribute ransomware, credential stealers, or other malware.

Eye estimates it encountered 2.5–3 million Windows hosts and 250,000–350,000 Macs. Windows identifier collisions initially understated device numbers, while changing identifiers on macOS inflated them.

Popocorn Time users
Eye Security

Disabling the updater remotely

With the software abandoned and no vendor patch forthcoming, Eye consulted its legal team and used the vulnerable mechanism itself to deliver code that disabled the updater.

On Windows, the payload stopped and disabled the service named “Update service.” On macOS, it disabled the launch daemon responsible for starting PT.updd. Eye says these payloads collected no telemetry and deleted no files.

The intervention involved executing code on users’ computers without individual approval. Eye justified the decision by citing the scale of exposure and absence of a functioning vendor.

Security products complicated the operation by flagging the Windows payload as malicious. Eye modified its code to reduce detections, saying blocked deployments left the vulnerable updater active.

By March 1, update requests to Eye’s domains had fallen by 98%, and it had served more than two million update downloads. In late March, Eye transferred its 15 domains to the Shadowserver Foundation for sinkholing, but other domains remained outside its control.

Android installations received no intervention because updates required user interaction, and the updater couldn’t be disabled independently.

Eye recommends uninstalling the affected software. Disabling its updater leaves the application’s other weaknesses intact, including an obsolete Chrome engine, a disabled sandbox, unencrypted connections, and JavaScript loaded from abandoned domains.