Between November 2025 and March 2026, cybersecurity firm Eye Security quietly released more than two million automatic updates to computers it does not own. The goal was to disable a leftover background updater in Time4Popcorn—a discontinued clone of the pirated streaming app Popcorn Time—that posed a serious security risk. The updater in question could have enabled attackers to hijack vulnerable machines.
The Threat Uncovered
Popcorn Time, once famous for using BitTorrent to stream pirated video, stopped officially in 2014. But copies have lingered, and in 2025 a new legal project adopted the name—distinct from the older, problematic versions. Eye Security, during a routine threat hunt in late 2025, spotted an executable called Updater.exe running on a client’s laptop. It kept trying to reach an expired domain. Eye then registered that domain to see what traffic it would get—and was overwhelmed. Almost 50 connection attempts per second came in. Over six months, more than 3.8 million unique hardware identifiers were collected. Adjusting for identifier reuse and platform differences, the firm estimates the updater was active on about 2.5–3 million Windows machines and 250,000–350,000 Macs. The Windows counterpart was version 6.2.1.18 or older; Mac up to 6.2.1.17. The updater also existed on Android (up to 3.5.0.173), where it could run only if a user accepted install prompts.
Why the Updater Was Dangerous
This updater ran with elevated privileges—SYSTEM on Windows and root on Mac—every time the system booted. It checked for updates over plain, unsecured connections, with no verification of the source. Because the domains it called were abandoned, anyone who registered one could issue malicious payloads to every machine still attempting updates, risking ransomware installs, password theft, or turning computers into botnet nodes. Analysis of networks contacting the updater revealed home users, corporate environments, and even government systems among those affected. The flaw was assigned CVE-2026-30612 and rated 9.8/10 by CISA.
Eye Security Fights Back
With no vendor left maintaining Time4Popcorn and no official patch forthcoming, Eye Security opted to weaponize the updater. After legal consultation, the firm delivered an update whose sole function was to disable that updater component—without collecting data or deleting any user files. Similar to previous campaigns like the 2021 anti-Emotet operation, this move sought to neuter the threat in the wild. By December 2025, the update had reached over one million machines. Traffic to the old domains dropped about 90%. By early March, daily updates had dwindled to around 5,000—roughly a 98% drop. In total, more than two million update downloads were completed.
What’s Fixed — And What’s Still Dangerous
Disabling the updater doesn’t render Popcorn Time safe. The app still relies on a 2014 browser engine past its kill date, lacks sandbox protections, pulls insecure content over unencrypted channels, and fetches code from long-expired web domains. Eye developed a proof-of-concept showing how those weaknesses could be exploited. The safest route is to uninstall the app entirely. For users who can’t remove it right away, Eye published instructions for turning off the updater manually: on Windows by stopping and disabling the “Update service”, and on Mac by unloading the PT.updd helper daemon. Android users are out of luck—the updater component is embedded and can’t be disabled separately. For stronger protection, check for updater files or traffic to any of the twenty domains listed in Eye’s security brief.
Analytical Angle: The Popcorn Time case demonstrates how abandoned software—here, a piracy tool long devoid of official support—can still pose massive risks. Left-unchecked updaters or similar background services become attack vectors, especially when they operate with root or system level access and point to unowned domains. Eye Security’s intervention raises ethical questions: when is it acceptable for third parties to push updates to machines they do not own? But given the scale of exposure and lack of alternatives, this may become an increasingly common tactic in cyber defense. It underscores the importance of maintaining software supply chains, ensuring domain ownership, and baking in fail-safe mechanisms. Watch closely for emerging norms and regulations around “good Samaritan updates” and unauthorized but arguably benevolent interventions in abandoned apps.
