A Forgotten Popcorn Time Updater Left Millions of PCs and Macs Open. Researchers Quietly Switched It Off With 2 Million Updates
A security firm found that an abandoned copy of the Popcorn Time streaming app kept calling unregistered web addresses for updates, ready to install anything as SYSTEM or root. It took over those addresses and pushed more than 2 million updates to disable the updater. Here is the story and why it matters for company PCs.
Most security stories start with an attacker. This one starts with a program nobody remembered installing. Dutch security firm Eye Security has described how it spent five months pushing more than 2 million updates to computers it did not own, with a single goal: switch off a background updater that could have given an outsider full control of millions of machines.
Our account is based on The Hacker News’ reporting, with additional detail from BleepingComputer.
A laptop that kept calling a dead address
During a routine threat hunt, Eye noticed a program called Updater.exe on a client’s laptop that kept trying to reach a web address that no longer existed. It belonged to Time4Popcorn, an abandoned copy of Popcorn Time, the once-popular app that streamed pirated films and TV over BitTorrent. (A separate, legal project that adopted the Popcorn Time name in early 2025 is unrelated.)
Eye registered the address to see who would call. About 50 requests a second arrived. Over six months the firm counted more than 3.8 million hardware IDs, which it later revised to an estimate of 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. Connections came from home internet providers and also from corporate, government and military networks, although BleepingComputer noted none of the users appeared to be actively using the app.
Why that was dangerous
The updater started with the computer, checked for new versions over an unencrypted connection, and installed whatever it received with the highest privileges (SYSTEM on Windows, root on Mac) without checking who sent it. Because its web addresses had been abandoned, anyone who registered the right one could have pushed ransomware, password stealers or botnet software to every machine still calling home. The flaw is tracked as CVE-2026-30612, and CISA rates it 9.8 out of 10. Affected versions are Windows up to 6.2.1.18, Mac up to 6.2.1.17 and Android up to 3.5.0.173.
Turning the updater against itself
With no company left to issue a patch, Eye took legal advice and used the updater to deliver an update that did one thing: stop and disable the updater. It deleted no files and collected no data. Eye compared the move to 2021’s Operation Ladybird, when Dutch police pushed an update to disable the Emotet botnet on infected computers.
By December 2025, more than 1 million systems had been updated and traffic was down about 90 percent. By March 1, traffic had dropped 98 percent. In late March, Eye handed the 15 addresses it controlled to the nonprofit Shadowserver Foundation. Eye presented the effort, which it calls Operation IXIM, at the Hack.lu conference on October 22. It found no sign that anyone else had served code through the addresses.
The parts that are still open
- Some addresses the updater calls were never Eye’s to take and remain with outside owners, so machines reaching them are still exposed.
- Android copies could not be fixed remotely, because the update needs the user to tap to accept.
- The app itself remains risky. Eye says it runs a 2014-era browser engine with its security sandbox off and loads content over unencrypted connections.
What this means for your company
If a few million forgotten installs turned up on corporate and government networks, there is a fair chance some exist on your laptops too, along with other old freeware nobody uses. Run a software inventory across company devices and remove anything unapproved or abandoned. For this case specifically, look for Updater.exe on Windows and PT.updd on Mac, and uninstall Popcorn Time where you find it. Eye lists manual commands to disable the updater, but removing the app is the safer fix. Going forward, limit who can install software, and flag any program that updates itself over plain HTTP.
Need help finding and removing forgotten or unapproved software across your company’s computers? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
