Dutch security firm Eye Security says it delivered more than 2 million update downloads between November 2025 and March 2026 to disable a vulnerable background updater on computers it did not own. The component belonged to Time4Popcorn, an abandoned Popcorn Time fork whose update mechanism could allow an attacker to run software with full system privileges on Windows and Mac.
The operation, named Operation IXIM, addressed a weakness now tracked as CVE-2026-30612. Eye says no patch is available because the software is abandoned, and recommends removing it completely. The research does not apply to the separate legal project that began using the Popcorn Time name in early 2025.
An expired domain exposed a privileged update channel
Eye discovered the updater during a routine threat hunt on a client's laptop. A process named Updater.exe repeatedly tried to contact an unregistered web address. After the firm registered that address, it received roughly 50 requests per second, according to The Hacker News.
The Windows and Mac updaters started automatically at boot and checked for new versions over an unencrypted connection. They accepted updates without authenticating their source, then executed them without user interaction as NT AUTHORITY\SYSTEM on Windows or root on Mac. An attacker able to manipulate that traffic—including by registering an abandoned update domain—could supply a malicious update.
Eye said this access could enable ransomware installation, password theft or recruitment into a botnet. Those were potential consequences: the firm reported finding no evidence that another party was delivering code through the update addresses. Domains already registered by others were parked or offered for sale.
Over six months, Eye observed more than 3.8 million distinct hardware IDs. Those identifiers did not translate reliably into a device count: some Windows computers shared an ID, while some Macs changed theirs. Eye subsequently estimated the population at 2.5 million to 3 million Windows computers and 250,000 to 350,000 Macs.
A sample of connecting addresses suggested home users worldwide and machines on government, military and corporate networks. Eye cautioned that it was difficult to draw conclusions from that mapping.
The Hacker News lists affected Time4Popcorn releases as Windows versions up to and including 6.2.1.18, Mac versions up to and including 6.2.1.17, and Android versions up to and including 3.5.0.173. It reports a CISA severity rating of 9.8 out of 10. The vulnerability was absent from CISA's Known Exploited Vulnerabilities catalog as of October 23, 2026.
Disabling the updater through its own infrastructure
After taking legal advice, Eye used the update channel to distribute a program that it said only stopped and disabled the updater, without deleting files or collecting data.
Antivirus detection complicated delivery. After someone uploaded the disabling update to VirusTotal, security engines began flagging it. Eye said blocked deliveries left the vulnerable updater active, so it revised the program until only one scanner continued to detect it.
By December 2025, Eye said it had updated more than 1 million systems and reduced traffic to its controlled addresses by about 90 percent. By March 1, delivery had fallen to approximately 5,000 updates a day, which it described as a 98 percent reduction. The firm stopped after judging the remaining volume too small to attract a botnet operator. Its total of more than 2 million update downloads is not a verified count of distinct computers protected.
In March, Eye transferred its 15 controlled domains to the Shadowserver Foundation. Registration records for popcorntimeupd[.]xyz show a March 20, 2026 transfer and now point to Shadowserver sinkhole servers. Other update addresses remained under outside ownership, leaving machines contacting those destinations exposed.
Eye presented the operation at Hack.lu on October 22.
Removing the application remains the recommended remedy
Disabling the updater leaves other weaknesses in place. Eye said the application uses a 2014 browser engine with its security sandbox disabled, retrieves content over unencrypted connections and loads code from abandoned domains. The firm registered those domains too and built a working proof of concept, but said it did not use them to execute code on users' computers.
In its Time4Popcorn advisory, Eye recommends uninstalling the software. Windows users can stop and disable the update service with:
sc.exe stop "Update service"
sc.exe config "Update service" start= disabled
On Mac, the privileged helper can be unloaded with:
launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
On Android, update checks occur only when the application is opened, and installing a supplied APK requires user acceptance. Eye did not send its disabling update to Android devices. Because that updater is embedded in the application, Eye recommends removing the app entirely.
For endpoint checks, defenders can look for Updater.exe, typically under C:\Program Files (x86)\Popcorn Time\ or C:\Program Files\Popcorn Time\, and the Mac helper at /Library/PrivilegedHelperTools/PT.updd.
