Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Eye Security discovered the issue during a routine threat hunt on a client's laptop, where a program called Updater.exe kept trying to reach a web address that was no longer registered. The firm registered the address itself and observed about 50 requests a second pouring in, carrying more than 3.8 million different hardware IDs over six months.

The updater ran in the background from the moment the computer started, checking for new versions over an unencrypted connection and installing whatever it was sent at the highest privilege level, called SYSTEM on Windows and root on Mac, without checking who sent it. Because the web addresses it called had been abandoned, Eye said, anyone who registered the right one could have served their own program to every machine still calling it.

On a machine with that access, an attacker could install ransomware, steal saved passwords, or pull the computer into a botnet. Mapping a sample of the connecting addresses, the firm saw home users around the world, as well as machines on government, military, and corporate networks, though it added that it is "hard to draw conclusions" from that.

Eye had disclosed the flaw, now tracked as CVE-2026-30612, in June. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. It affects three versions of the Time4Popcorn software: Windows up to and including 6.2.1.18, Mac up to and including 6.2.1.17, and Android up to and including 3.5.0.173.

Using the Updater Against Itself

With no company left to fix the software and no patch coming, Eye decided to use the updater against itself. After taking legal advice, it served the machines an update that does one thing: it stops and disables the updater, deleting no files and collecting nothing. The firm compared the step to Operation Ladybird in 2021, when Dutch police pushed an update to computers infected with the Emotet botnet to disable the malware on them.

Soon after the updates began, someone uploaded Eye's update to VirusTotal, and antivirus engines started flagging it as malware, a fair description of a program that disables a Windows service. Because every product that blocked it left the vulnerable updater running, Eye reworked the update until only one scanner continued to flag it.

By December 2025, Eye had updated more than 1 million systems and cut the traffic to its web addresses by about 90 percent. By March 1, it was sending about 5,000 updates a day, a 98 percent reduction. Judging the remaining numbers too small to interest a botnet operator, Eye stopped, having sent more than 2 million update downloads in all.

Handing Over the Domains

In late March, Eye handed the 15 web addresses it controlled to the Shadowserver Foundation, a non-profit that takes abandoned and malicious domains out of circulation, so a trusted party would hold them rather than Eye. Public registration records for one of them, popcorntimeupd[.]xyz, now point to Shadowserver's sinkhole servers, with a transfer dated March 20, 2026.

Eye found no sign that anyone else was serving code through the addresses: the ones already registered by other people were parked or up for sale, not pushing updates to the machines calling them. The flaw is not listed in CISA's catalog of known exploited vulnerabilities as of October 23, 2026.

Switching off the updater does not make the app safe. Eye said Popcorn Time runs on a 2014 browser engine with its security sandbox turned off, loads content over unencrypted connections, and pulls in code from other abandoned web addresses. Eye registered those abandoned addresses too, which it said would have let it run its own code on every machine that opened the app. It did not, but it built a working proof of concept, so the risk is real.

What Popcorn Time Users Should Do

Eye's advice is to uninstall Popcorn Time. The updater can also be turned off by hand: on Windows with two commands that stop and disable its "Update service," and on a Mac with one that unloads the PT.updd helper. Removing the app is the safer step, because disabling the updater leaves the rest of it in place.

On Android, the updater is built into the app and cannot be turned off on its own, and it installs only if the user taps to accept, so Eye did not send updates to Android devices. Removing the app is the only fix there. To check a network, defenders can look for the two updater files, Updater.exe on Windows and PT.updd on Mac, and for traffic to the web addresses in Eye's write-up, which lists all 20 domains and the file hashes.