Eye Security exploited a flaw in a Popcorn Time clone to neutralize it on millions of machines

It all starts with a threat hunt at an Eye Security client. On a laptop, a process named Updater.exe tries to reach popcorntimeupd.xyz, a domain that no longer exists. The researchers register it to see who comes knocking. They receive about 50 requests per second.

The requests came from Time4Popcorn, a closed-source variant of Popcorn Time, the BitTorrent streaming software. Its update system fetched new versions over unencrypted HTTP and checked no signature. It then ran the file it received with SYSTEM privileges on Windows and root on macOS. Anyone who controlled one of its expired domains could therefore install whatever they wanted on these machines. The flaw is tracked as CVE-2026-30612. Eye Security published the full account of the operation on October 22, under the name Operation IXIM.

Millions of computers at the mercy of the first comer

Over six months, Eye counted more than 3.8 million distinct hardware identifiers. The company itself considers this figure unreliable: cloned disk images duplicate identifiers on Windows, and those on Macs change with the machine's name. It finally estimates the population at 2.5 to 3 million Windows machines and 250,000 to 350,000 Macs. The connections came from individuals, but also from corporate networks, government agencies and armed forces. The update service launched by itself at startup: many of these machines remained exposed, even though many users had probably forgotten the application and no longer used it, according to the researchers.

There was no longer a vendor to issue a fix. Eye says it consulted its legal department, then made an unusual decision: to use the flaw itself. Between November 2025 and March 2026, its servers sent more than two million "updates" that did only one thing: stop and disable the update service on Windows, and the PT.updd daemon on macOS. According to Eye, this code collected no data and deleted no files. By March 1, 2026, requests had dropped by 98%. At the end of March, the company handed its 15 domains over to the Shadowserver Foundation, which sinkholes them.

Why the danger has not gone away

The intervention does not solve everything. On Android, Eye could do nothing: installing an update requires the user's consent, and the service cannot be disabled remotely. Some update domains still belong to third parties. Above all, the application embeds a 2014 Chrome engine, with no sandbox, that loads content over HTTP. The researchers say they launched the Windows calculator with simple JavaScript, in a proof of concept.

What should you do?

The company recommends uninstalling the software: turning off the update service is not enough.

• Look for Updater.exe in C:\Program Files\Popcorn Time\ on your Windows machines, and for PT.updd in /Library/PrivilegedHelperTools/ on your Macs.
• Search your DNS and proxy logs for the domains listed by Eye, including time4popcorn.info and popcorntimeupd.xyz.
• Uninstall Time4Popcorn everywhere, including on Android phones. According to Eye, the Popcorn Time project relaunched in early 2025 is not affected.

The case shows that an update mechanism can become an entry point, as with the booby-trapped updates of the AOMEI backup software. It also opens a debate: can a private company remotely modify millions of machines that do not belong to it, even to protect them? Eye cites the Dutch police operation against the Emotet malware. No authority has yet ruled on its initiative.