Popcorn Time's Abandoned Updater: What the Botnet Near-Miss Means

By Jaspal Singh October 24, 2026 Updated: October 24, 2026

An abandoned Popcorn Time fork called Time4Popcorn left a background updater running on millions of Windows and Mac computers. It asked lapsed web domains for instructions over plain HTTP and would run whatever file came back with full system rights. Security firm Eye Security registered one domain and pushed a "benevolent update" to switch the updater off.

What Happened

The story started with a single laptop. During a routine threat hunt, Dutch security company Eye Security spotted a process called Updater.exe on a client machine trying to reach popcorntimeupd.xyz, a domain that nobody owned any more. The program belonged to Time4Popcorn, a closed-source fork of the BitTorrent streaming app Popcorn Time that spread widely under the Popcorn Time name after the original project was shut down for legal reasons.

Eye registered the domain to see what would happen. According to the company's full write-up, Operation IXIM: Preventing a botnet of millions of Popcorn Time users, it immediately received about 50 requests per second. Each request carried a hardware ID, the app version and the operating system. Over six months Eye logged more than 3.8 million distinct hardware IDs, roughly half from Windows, about 45% from macOS and under 5% from Android. Because those IDs turned out to be unreliable, Eye's own estimate of real machines is 2.5 to 3.0 million Windows hosts and 250,000 to 350,000 Macs. Connections came from home broadband lines, but also from corporate, government and military networks.

The flaw was published as CVE-2026-30612 on June 11, 2026, with researcher Niels Teusink credited. Between November 2025 and March 2026, Eye used the updater itself to deliver a small program that stopped and disabled the updater on the machines that asked. By December 2025 it had reached more than one million systems; update requests fell about 90% within weeks; and by March 1, 2026 daily traffic was down 98%, to roughly 5,000 update requests a day. Eye stopped offering the update in March after more than 2 million downloads, then handed 15 domains it had registered to The Shadowserver Foundation, a nonprofit that runs sinkholes for exactly this kind of traffic, in late March.

Teusink presented the work at hack.lu in Luxembourg on October 22, 2026 (talk listing); BleepingComputer and The Verge reported it on October 23.

Why It Matters

The obvious point is scale. Anyone who had registered that domain first, a criminal group rather than a security firm, could have pushed ransomware or a botnet client to millions of computers in a single afternoon. Eye summed up the risk in its own words: "If we were able to send an update, we could potentially get code execution on millions of systems." No exploit kit, phishing email or user click would have been needed, because the victims' own software was already polling for orders.

The less obvious point is that nobody was really using the app. Eye's traffic suggests most of these installs were forgotten: someone tried Popcorn Time years ago, closed the window, and never uninstalled it. The updater kept running at every boot as a system service regardless. The pattern is not unique to piracy apps. Any program that installs its own always-on update service outlives its developer, and when the developer stops paying for the domain, the update channel goes up for sale.

It also matters for organisations: corporate, government and military networks showed up in the logs, so unmanaged software with SYSTEM rights was sitting on managed fleets.

Finally, the remediation itself is unusual and contested. Eye changed settings on computers it did not own, without their owners' consent, and cites the 2021 police operation against the Emotet malware as precedent. But that was law enforcement acting on criminal malware; this was a private company acting on an abandoned app.

How It Works

The update loop

On Windows, Time4Popcorn installs a service named "Update service" that runs Updater.exe from the Popcorn Time folder under Program Files. On macOS it installs a privileged helper, /Library/PrivilegedHelperTools/PT.updd, launched by /Library/LaunchDaemons/PT.updd.plist. Both start at boot and check in periodically. They send an ordinary HTTP GET request to the update domain and expect a short JSON reply.

That reply is where everything goes wrong. Eye found that a JSON response containing a link to an executable was enough: the updater downloaded the file and ran it, as NT AUTHORITY\SYSTEM on Windows and as root on macOS. There was no HTTPS, so anyone on the network path could tamper with the reply, and there was no check that the downloaded file was signed by the developer. Whoever answers the question "is there an update?" gets full control of the computer.

Why a lapsed domain is the whole attack

A domain registration is a rental, usually renewed yearly. When an abandoned project stops paying, the name returns to the pool and anyone can buy it for a few dollars. Some of the updater's other domains were already held by resellers asking thousands of dollars. Owning the domain means owning the DNS answer, which means owning every request the updater sends. Code signing exists precisely to break that chain: a properly built updater refuses any file not signed with the developer's private key, so even a hijacked domain could only serve files it cannot get the updater to run.

The benevolent update

Eye's fix used the same weakness against itself. On Windows its payload ran the standard Service Control Manager commands to stop the "Update service" and set it to disabled. On macOS a shell script ran launchctl unload -w on the PT.updd launch daemon. Eye says the payload collected no telemetry and deleted no files. Early on it served only hardware IDs it had already seen, once each, loosening those limits after a clean small test.

Antivirus products complicated things. About a week after release someone uploaded the payload to VirusTotal, where 11 vendors flagged it as potentially malicious; disabling a service silently is, after all, what malware does. Eye modified the code until only one engine still flagged it.

Hardware IDs that were not unique

Counting was harder than it looks. A Windows registry bug meant laptops built from the same disk image could share one hardware ID, while MAC address randomisation and renamed hosts made one Mac look like several. That is why Eye's Mac estimate fell from an early 1.7 million to 250,000 to 350,000.

What's Still Unknown

Turning off the updater did not make Time4Popcorn safe, and Eye says so plainly. The app is built on a Chromium-based engine from 2014 with its sandbox disabled, talks over unencrypted HTTP and loads JavaScript from abandoned domains. Eye registered those script domains but did not use them, and built a proof of concept that launched the Windows calculator through injected JavaScript.

Android is also unresolved. The Android app has no background service; it checks for updates when opened and asks the user to approve an APK. That means it could not be switched off remotely, and a hijacked domain could still offer a malicious install to anyone who taps yes. Eye's advisory lists Android with Windows and macOS as affected.

It is not known how many installs never received the fix, for example machines that were offline for the whole window, sat behind proxies, or used update domains Eye never controlled. Some of those domains remained with third parties. Nor is it known whether anyone else found the flaw first; Eye has not reported evidence of malicious use, which is not the same as proof there was none. And the legal position of an unconsented private fix like this has not been tested in court.

Frequently Asked Questions

Is the official Popcorn Time app affected by CVE-2026-30612?

Eye Security says no. The flaw is in Time4Popcorn, a closed-source fork distributed under the Popcorn Time name, not in the newer legal project that started using the name in early 2025. The trouble is that many people cannot tell which version they installed years ago. If an old copy is sitting on your computer, treat it as Time4Popcorn and remove it rather than guessing.

How do I know if the Time4Popcorn updater is on my computer?

On Windows, look for a "Popcorn Time" folder under Program Files or Program Files (x86) containing Updater.exe, or a service called "Update service" in the Services panel. On a Mac, check for /Library/PrivilegedHelperTools/PT.updd and /Library/LaunchDaemons/PT.updd.plist. On Android, look for a Popcorn Time app in your app list. Any of these means the old fork is installed.

Did Eye Security's update remove Popcorn Time from my computer?

No. The update only stopped the background updater service and set it to disabled on Windows, or unloaded the launch daemon on macOS. The app itself, its files and any downloads stayed in place, and Eye says nothing was deleted or collected. The outdated 2014 browser engine inside the app is still there, so the software remains unsafe to open.

What should I do if I still have Popcorn Time installed?

Uninstall it completely; Eye's guidance is that the software is "just not safe to use anymore." If you want to stop the service first, Windows administrators can run sc.exe stop "Update service" and then sc.exe config "Update service" start= disabled. On macOS, run launchctl unload -w on the PT.updd plist. Then delete the app and its leftover folders.

Was it legal for a security company to change settings on millions of PCs?

That is the most debated part of the story. Eye says its legal team advised on the plan and compares it with the 2021 Emotet takedown, when police pushed an uninstaller to infected machines. But Eye is a private company, owners never consented, and the law in many countries forbids unauthorised changes to computers regardless of intent. No court has ruled on this case.

Why did antivirus tools flag a fix as malware?

Because from the outside it behaved like malware. The payload arrived through an unsigned updater, ran with SYSTEM or root rights, and silently disabled a service, all classic signs of malicious software. When it was uploaded to VirusTotal, 11 security vendors flagged it. Eye adjusted the code until only one engine still detected it, which itself shows how easily signature-based detection can be avoided.

Can the same thing happen with other abandoned software?

Yes, whenever an app ships a background updater that trusts its download domain without verifying signatures. If the developer disappears and the domain lapses, whoever buys it inherits control of every install still checking in. Safer updaters fetch over HTTPS and refuse any file that is not signed with the developer's key. Removing software you no longer use is the simplest defence.

Who controls the Popcorn Time update domains now?

Eye registered 15 of the domains and transferred them to The Shadowserver Foundation in late March 2026. Shadowserver is a nonprofit that sinkholes malicious and abandoned domains, logs connections and shares data with network owners so they can find and clean affected machines. Some other domains the updater used remained with third parties, which is one reason uninstalling still matters.