Ethical Hacking News
Eye Security has pushed over 2 million updates to disable the Popcorn Time updater, a potentially vulnerable piece of software that could have been used to take control of machines. The update was sent to computers that Eye did not own, and it was done without the consent of the machines' owners. The move is a significant one, and it highlights the ongoing struggle between cybersecurity firms and malicious actors in the world of software vulnerabilities.
The Dutch security firm Eye Security pushed over 2 million updates to computers it didn't own to disable a potentially exploitable background updater. The updater was part of an abandoned copy of the Popcorn Time app, which streamed pirated content and had been running in the background for years. The updater was vulnerable to exploitation, allowing attackers to install ransomware, steal passwords, or pull the computer into a botnet. Eye Security discovered the updater during a routine threat hunt and took steps to disable it, serving an update that stops and disables the updater on affected machines. By December 2025, Eye had updated over 1 million systems and reduced traffic to the updater's web addresses by 98%. The updater can still pose a risk to users who continue to use Popcorn Time, even with the updater disabled. Removing the Popcorn Time app is the recommended fix to avoid potential security risks.
In the realm of cybersecurity, the world of vulnerability and exploits is a complex and ever-evolving landscape. Recently, a Dutch security firm known as Eye Security made headlines by pushing over 2 million updates to computers that it did not own, in order to remotely disable a background updater that could have potentially been exploited by malicious actors to take control of the machines. This story serves as a poignant reminder of the importance of patching and the need for vigilance in the face of evolving threats.
The updater in question belongs to an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was popular around a decade ago, but the original shut down in 2014. Despite this, several copies of the app continued to run under the same name. A separate, legal project that took the Popcorn Time name in early 2025 is unrelated to the original.
Eye Security discovered the updater during a routine threat hunt, where a program called Updater.exe on one client's laptop kept trying to reach a web address that was no longer registered. The firm registered the address itself to see what would connect, and about 50 requests a second poured in. This led the firm to lay out the operation, which it named Operation IXIM, in a write-up and a talk at Hack.lu on October 22.
Over the course of six months, those requests carried more than 3.8 million different hardware IDs. The IDs proved an unreliable way to count machines, because some Windows PCs shared one and some Macs changed theirs. As a result, Eye revised its estimate to 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs.
The updater ran in the background on both Windows and Mac from the moment the computer started. It checked for new versions over an unencrypted connection and installed whatever it was sent, at the highest privilege level, called SYSTEM on Windows and root on Mac, without checking who sent it. Because the web addresses it called had been abandoned, Eye said, anyone who registered the right one could have served their own program to every machine still calling it.
On a machine with that access, an attacker could install ransomware, steal saved passwords, or pull the computer into a botnet, Eye said. Mapping a sample of the connecting addresses, the firm said it saw home users around the world, as well as machines on government, military, and corporate networks, though it added that it is "hard to draw conclusions" from that.
Eye had disclosed the flaw, now tracked as CVE-2026-30612, in June. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. It affects three versions of the Time4Popcorn software: Windows, up to and including 6.2.1.18, Mac, up to and including 6.2.1.17, and Android, up to and including 3.5.0.173.
To combat the threat, Eye decided to use the updater against itself. After taking legal advice, it served the machines an update that does one thing: it stops and disables the updater, deleting no files and collecting nothing. This tactic was compared to Operation Ladybird in 2021, when Dutch police pushed an update to computers infected with the Emotet botnet to disable the malware on them.
The difference, Eye said, is that Emotet's victims never chose to be infected, while Popcorn Time's users installed the app themselves. Still, the firm said, "none of them chose to have a forgotten updater running in the background for years." Soon after the updates began, someone uploaded Eye's update to VirusTotal, and antivirus engines started flagging it as malware, a fair description of a program that disables a Windows service.
Because every product that blocked it left the vulnerable updater running, Eye reworked the update until only one scanner continued to flag it. By December 2025, Eye had updated more than 1 million systems and cut the traffic to its web addresses by about 90 percent. By March 1, it was sending about 5,000 updates a day, a 98 percent reduction. Judging the remaining numbers too small to interest a botnet operator, Eye stopped, having sent more than 2 million update downloads in all.
In late March, Eye handed the 15 web addresses it controlled to the Shadowserver Foundation, a non-profit that takes abandoned and malicious domains out of circulation, so a trusted party would hold them rather than Eye.
Popcorn Time users should be aware that switching off the updater does not make the app safe. Eye said Popcorn Time runs on a 2014 browser engine with its security sandbox turned off, loads content over unencrypted connections, and pulls in code from other abandoned web addresses. Eye registered those abandoned addresses too, which it said would have let it run its own code on every machine that opened the app. It did not, but it built a working proof of concept, so the risk is real.
The update only changed the updater, so the rest of the app remains dangerous for anyone who keeps using Popcorn Time. The updater can also be turned off by hand: on Windows with two commands that stop and disable its "Update service," and on a Mac with one that unloads the PT.updd helper. Removing the app is the safer step, because disabling the updater leaves the rest of it in place.
Windows: sc.exe stop "Update service"
Windows: sc.exe config "Update service" start= disabled
Mac: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
On Android, the updater is built into the app and cannot be turned off on its own, and it installs only if the user taps to accept, so Eye did not send updates to Android devices. Removing the app is the only fix there.
To check a network, defenders can look for the two updater files, Updater.exe on Windows and PT.updd on Mac, and for traffic to the web addresses in Eye's write-up, which lists all 20 domains and the file hashes.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Shadowy-World-of-Abandoned-Popcorn-Time-Updater-A-Tale-of-Vulnerability-and-Evasion-ehn.shtml
https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
Published: Sat Oct 24 06:38:49 2026 by llama3.2 3B Q4_K_M
