Supply chain

Popcorn Time updater left millions open to takeover

By Yaali. October 25, 2026, 6 min read, Supply chain, Threat intel, Windows.

Eye Security pushed over 2 million updates to disable an abandoned Popcorn Time updater that ran code as SYSTEM. How to find and remove it on your endpoints.

Time4Popcorn, a fork of the Popcorn Time movie streaming client that nobody has maintained for years, ships an updater that starts at boot, asks a list of domains for new versions over plain HTTP, and runs whatever it is given as SYSTEM on Windows or root on macOS. Many of those domains had lapsed. Anyone who registered one could have run code on millions of machines, including some on corporate, government and military networks.

Dutch security firm Eye Security found the problem, registered 15 of the domains, and between November 2025 and March 2026 served more than 2 million update downloads that switched the updater off. It presented the work, called Operation IXIM, at Hack.lu on October 22. If staff ever installed Popcorn Time on a work laptop, or on a personal device that reaches company systems, the client is still there and still unsafe, so this is worth an hour of endpoint hunting this week.

How the updater works

On Windows the installer adds a service named "Update service" that runs Updater.exe from C:\Program Files\Popcorn Time\ or C:\Program Files (x86)\Popcorn Time\. On macOS it installs a privileged helper, /Library/PrivilegedHelperTools/PT.updd, loaded by the launch daemon /Library/LaunchDaemons/PT.updd.plist. Both start at boot and poll on a timer, whether or not the user ever opens the app again.

Each poll is a plain HTTP GET such as /?app_id=T4PSEC&hid=<id>&ver=6.1.0.0&os=WIN060200, where hid is a hardware ID. The updater expects a JSON reply that contains a download link. It fetches that file and runs it with the service's privileges. There is no code signing check and no TLS (Transport Layer Security), so the only thing standing between a stranger and a SYSTEM shell is ownership of the domain or a position on the network path.

The flaw is tracked as CVE-2026-30612, rated 9.8 (Critical) in the CISA vulnerability enrichment data and classed as CWE-494, download of code without an integrity check. Affected builds are Windows 6.2.1.18 and earlier, macOS 6.2.1.17 and earlier, and Android 3.5.0.173 and earlier. There is no fixed version because there is no vendor. The unrelated, newer Popcorn Time project at popcorntime.app, started in early 2025, is not affected.

Android works differently. It has no background service; the app checks for updates when it is opened and asks the user to install an APK. That makes it slower to abuse but also impossible to switch off remotely.

What Eye Security found and did

The trail started with a threat hunt. Eye's managed security team saw Updater.exe on a client laptop trying to reach popcorntimeupd.xyz, a domain that was no longer registered. Eye registered it and was soon receiving about 50 requests per second.

Over six months it counted more than 3.8 million distinct hardware IDs, about half Windows, about 45% macOS and under 5% Android. That figure overstated the real number. On Windows the ID is an MD5 hash of the C: volume serial, the volume GUID and the MachineGuid registry value, but a reversed error check means the MachineGuid is usually skipped. Laptops deployed from the same disk image therefore share an ID. On macOS the ID mixes MAC addresses with the hostname, so MAC randomisation and DHCP hostname changes create phantom new machines; one IP address reported 11 IDs in a day. Eye first counted about 1.7 million macOS IDs; its revised estimate is 2.5 to 3.0 million Windows hosts and 250,000 to 350,000 Macs.

After reverse engineering both updaters, Eye served a "benevolent update" to anything that asked. On Windows it stops the service and sets it to disabled through the Service Control Manager. On macOS a script runs launchctl unload -w on the daemon's plist. Eye says the payload collected no telemetry and deleted no files. Within a week of it reaching VirusTotal, 11 antivirus engines flagged it as malware for disabling a service, which is an accurate description, and Eye had to rework it to get past them.

More than a million systems took the update by December 2025, and requests fell 90% within weeks. By March 1, 2026 Eye was down to about 5,000 updates a day, a 98% drop. In late March it handed its 15 domains to The Shadowserver Foundation for sinkholing. Some of the 20 known update domains are still held by third parties, and nobody can say whether a criminal used the HTTP channel before Eye arrived.

What to do

Removing the software is the only real fix. Eye found that the main application runs a 2014 Chrome engine with the sandbox disabled, loads content over HTTP, and pulls JavaScript from abandoned domains. Eye built a proof of concept that launched calc.exe that way. A disabled updater does not make the app safe.

1. Hunt for the files and service. In your EDR (endpoint detection and response) or software inventory, search for Updater.exe under any Popcorn Time folder, a service whose display name is "Update service", the file PT.updd, and PT.updd.plist under /Library/LaunchDaemons/. Generic names like "Update service" also match legitimate software, so filter on the path.
2. Hunt in DNS and proxy logs. Search for lookups of any of the 20 domains Eye published, including popcorntimeupd.xyz, popcorntime-update.xyz, updpopcorntime.xyz, time4popcorn.info, pctupd.info and t4p-upd.info, and for HTTP requests whose query string contains app_id=T4PSEC. A hit tells you which internal IP still runs the client even if the endpoint is not enrolled in your EDR.
3. Uninstall it. Remove the app and confirm the service, binary and launch daemon are gone afterwards. On Android, uninstall the app; there is nothing to disable.
4. If removal has to wait, disable the updater. On Windows run sc.exe stop "Update service" and sc.exe config "Update service" start= disabled. On macOS run sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist. Then block the domain list at your DNS resolver.
5. Check for earlier abuse. On any machine where you find it, review what the service launched as child processes and what new executables appeared in its folder or in temp paths. Eye cannot rule out that someone else served updates before it took the domains over, so a host with unexplained children of Updater.exe should be treated as compromised and rebuilt, with credentials used on it rotated.
6. Stop it coming back. Add the app to your application control block list and to whatever policy governs personal devices that reach company mail, VPN or SaaS.

Update channels outlive their software

This case did not need a vulnerability in any server. The publisher walked away, the domains expired, and every installed copy kept asking for instructions. The same pattern applies to old browser extensions, discontinued utilities, and vendor agents left behind after a contract ends: anything with a privileged updater that trusts a hostname is only as safe as that hostname's registration.

When you review endpoint inventory, list software that runs a privileged update service and ask two questions of each: is the vendor still alive, and does the updater check a signature before running what it downloads? Anything that fails either belongs on the removal list.

Our security operations team hunts for leftover software and dead update channels like this one, and our safeguarding and hardening work sets up the application control that keeps it off endpoints. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Eye Security, Operation IXIM, Eye Security, CVE-2026-30612 advisory, BleepingComputer, The Hacker News, OpenCVE, CVE-2026-30612, Hack.lu 2026 talk.