Security researchers have disabled a vulnerable updater linked to Time4Popcorn, an abandoned version of Popcorn Time, across millions of systems after identifying a security weakness that could have allowed unauthorized control of affected devices. Between November 2025 and March 2026, Dutch cybersecurity firm Eye Security delivered more than 2 million updates to computers it did not own to deactivate the background updater, which the company said could have been abused by an outside party to distribute malicious software. The affected updater belonged to Time4Popcorn, a separate copy of the original Popcorn Time application that allowed users to stream content through BitTorrent. While the original Popcorn Time project shut down in 2014, several versions continued operating under the same name. Eye Security discovered the issue during routine threat monitoring when it observed an Updater.exe process on a client device repeatedly attempting to connect to an inactive web address. The company registered the domain to analyze the activity and observed around 50 requests per second from systems attempting to reach it.
The operation, named Operation IXIM, revealed that the updater had remained active on millions of Windows and Mac systems. Over a six month period, the requests included more than 3.8 million hardware identifiers. Due to inconsistencies in device identification methods, including shared identifiers on some Windows systems and changing identifiers on Mac devices, Eye Security estimated that between 2.5 million and 3 million Windows computers and 250,000 to 350,000 Mac systems were affected. The company later presented details of the operation through a technical report and security conference session. According to Eye Security, the updater operated automatically when devices started and communicated through an unencrypted connection. It installed updates with elevated privileges, including SYSTEM access on Windows and root access on Mac, without verifying the authenticity of the source providing the update. Researchers warned that if an unauthorized party controlled the abandoned update domains, they could potentially deliver malicious programs to connected systems. Such access could have been used to install ransomware, steal stored credentials or include devices in a botnet.
The vulnerability was disclosed as CVE-2026-30612 and affects multiple Time4Popcorn versions, including Windows versions up to 6.2.1.18, Mac versions up to 6.2.1.17 and Android versions up to 3.5.0.173. The vulnerability received a high severity rating, with the U.S. Cybersecurity and Infrastructure Security Agency assigning a score of 9.8 out of 10. Eye Security said there was no indication that another party had used the abandoned domains to distribute malicious updates. Since the software no longer has an active development team, Eye Security decided to use the updater mechanism to deliver a security update that only disabled the vulnerable updater service. The company stated that the update did not delete files or collect user information. The action followed legal consultation and was compared by researchers to previous operations where security organizations used existing mechanisms to reduce malware risks.
After the update campaign began, some antivirus systems initially flagged the security update as potentially harmful because it modified a system service. Eye Security adjusted the update process to reduce false detections. By December 2025, the company had updated more than 1 million systems and reduced related traffic significantly. By March 2026, more than 2 million update downloads had been delivered before the company transferred control of the domains it managed to Shadowserver Foundation, allowing a trusted organization to maintain monitoring. Eye Security has advised users to uninstall Popcorn Time because disabling the updater does not remove other security concerns within the application. Researchers noted that the software relies on outdated components, uses insecure communication methods and interacts with abandoned web resources that could introduce additional risks. Users who continue running the application may remain exposed even after the updater has been disabled.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
