Popcorn Time Updater Left Millions of PCs Open to Whoever Owned Its Dead Web Addresses

Up to 3 million Windows PCs and 350,000 Macs kept asking dead web addresses for updates to a movie app from 2014. The owners did nothing wrong. The updater had the highest rights and ran whatever came back.

Then a security company registered those addresses and found out what they meant. Over the months that followed, it sent its own code to those computers more than 2 million times, on machines that were not its own.

Maybe you remember Popcorn Time. It came out in 2014 and let you stream films over BitTorrent. The original project shut down that same year, but copies carried on under other names. One of them, Time4Popcorn, was closed source, and its makers also handed it out as Popcorn Time. Maybe you installed it once, for one film, and never thought about it again. Its makers abandoned it. On millions of computers it stayed installed anyway, together with a small helper program that kept running in the background long after the film app itself was forgotten.

That helper turned up when researchers at Eye Security searched a customer’s network for signs of attackers, a job called a threat hunt. On a laptop, a process called Updater.exe kept trying to reach the address popcorntimeupd.xyz, and that domain was no longer registered. So they registered it themselves, to see what would show up. About 50 requests per second came in. That is more than 4 million a day.

Each request looked like this:

1

GET /?app_id=T4PSEC&hid=...&ver=6.1.0.0&os=WIN060200

The computer told the server which app it belonged to and gave a hardware ID for that one machine. It also sent a version number and the version of Windows it was running. It kept sending that to an address that had stopped being registered.

Over six months they saw around 3.8 million different hardware IDs. Some of those IDs were wrong, in two directions. A bug in the Windows updater left out the one value that is unique to each PC, so laptops cloned from the same disk image all ended up with one shared ID. Many PCs counted as one. On a Mac the ID most likely changed whenever the hostname changed, so one Mac could show up many times.

After correcting for that, they landed on 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. Android made up less than 5 percent.

The updater asked the address whether there was a new version. The question and the answer travelled over plain HTTP, so without encryption. The answer was a short JSON message, a few lines of text that pointed to a program. The updater downloaded that program and started it, and because the updates carried no signature, it never checked who had made what it was about to run. The Mac version expected a very different JSON message.

And owning the domain was only one way in. Because the traffic was not encrypted, the researchers’ own security advisory warns that whoever can tamper with it on the way can slip in an update of their own. On a hacked router or a fake WiFi hotspot, the request can be answered by someone in between, no matter who owns the domain.

On Windows, Updater.exe runs as a service under NT AUTHORITY\SYSTEM. That is the Windows account with more rights than an administrator, more than you have yourself when you log in. On a Mac, PT.updd runs as root, the Mac account with full control. On both it works in the background, and you see nothing. Whoever controls the answer can run any program on your computer.

The flaw now has a public ID, CVE-2026-30612. CISA, the US cyber agency, rates it 9.8 out of 10. It covers the Windows versions up to 6.2.1.18, macOS up to 6.2.1.17 and Android up to 3.5.0.173.

Android works differently, because it has no background updater. The app checks for a new version when you open it and then asks whether you want to install it. An attacker who controls the answer can still put their own app in front of you, and you only have to tap yes.

The requests came from home internet connections around the world. They also came from company networks, and from government and military networks. Many of the people behind those computers, the researchers think, had forgotten about the software years ago and were no longer using it. It was a film app someone installed once, still running with the highest rights on the machine.

Normally you warn the maker of the software. Here there was no maker to call. The researchers called the people behind the app pirates, and asked what those pirates could have done about it even if they had reached them. The only party that could close the hole was whoever held the address, and that was now them. Doing nothing, they wrote, would not make the world any better.

They compare what they were about to do with the police action against Emotet. In January 2021, police took over that botnet and pushed an update through its own channel to the computers it had infected. On April 25, 2021, that update removed the malware. It only deleted the malware’s Windows services and its autorun registry key, then stopped, and left everything else on the machine alone. One difference they point out themselves: the Popcorn Time users probably installed the software on purpose, where that botnet’s malware got onto computers without asking.

So they sent an update of their own. On Windows it stopped the service called Update service and switched it off. On a Mac it unloaded the background task that starts PT.updd. It collected no data and deleted no files. They started small. At first only machines they had already seen got the update, each ID got it a single time, and where possible they moved the connection over to HTTPS. After a few weeks they dropped those limits.

They began sending it in November 2025, and by December more than 1 million systems had it. A few weeks in, the requests had dropped by 90 percent. By March 1, 2026 they were down by 98 percent, though about 5,000 updates a day were still going out. In total, machines downloaded it more than 2 million times. In late March they handed their 15 domains to The Shadowserver Foundation. They published the advisory on June 11, 2026, and presented the full operation at the Hack.lu conference on October 22, 2026.

Antivirus products flagged their fix as malware, and from the outside it did look like malware: a program pushed over plain HTTP that started itself on computers that never asked for it. So they changed their code until the scanners stopped catching it. By their own count, one vendor still detects it.

In 2023, a French security company ended up in almost the same position. It paid 7 dollars for the IP address of a server that a self-spreading worm called PlugX still reported to. Between 90,000 and 100,000 unique addresses checked in each day, and more than 2.5 million over six months, from more than 170 countries.

The worm even had a built-in command to delete itself. The company did not send it. It wrote that sending commands to other people’s machines raised legal problems, so it left that decision to the police and national cyber teams in each country. French police then led the cleanup, with the company’s help. In the US, the FBI needed nine court warrants to delete the worm from about 4,258 computers, and the last one expired on January 3, 2025. Afterwards, the agency let the owners know through their internet providers.

The researchers’ writeup mentions no police or warrant for this operation, and no message to the owners. One line says their own legal team gave some advice, without saying what that advice was. So a company decided for itself to run code on more than 2 million computers it did not own. Those computers are safer because of it. And if one of them was yours, the writeup gives no sign that you were ever told. Who gets to make that call is still an open question.

Their fix only switched off the updater. It did not remove the app, and the app itself is still unsafe. It runs on a Chrome engine from 2014 with the sandbox turned off, the part of a browser that keeps a web page away from the rest of your system.

The app also loads parts of its code over plain HTTP from abandoned domains, and the researchers showed that this route can start a program on the computer. Some of the old Popcorn Time domains are still in the hands of third parties. On Android they could not switch the updater off at all, because it sits inside the app.

The official CVE record for the flaw, published on August 27, 2026, points its exploit link to a page about a WiFi router from a different company. That page has nothing to do with Popcorn Time. The record does not link to the researchers’ own advisory either.

Since early 2025, a new project has been using the Popcorn Time name to build a legal alternative, and that is separate software. The research here is about Time4Popcorn, the copy that was also handed out under the Popcorn Time name.

If you ever installed it, this is where the updater sits:

• → Windows: C:\Program Files\Popcorn Time\Updater.exe or C:\Program Files (x86)\Popcorn Time\Updater.exe
• → Mac: /Library/PrivilegedHelperTools/PT.updd
• → Android: inside the app itself

On Windows you can see whether the service still exists and whether it runs:

1

sc.exe query "Update service"

On a Mac, this shows whether the helper is still on the disk:

1

ls -l /Library/PrivilegedHelperTools/PT.updd

The advice from the researchers is short: uninstall it. If you cannot do that right away, these commands from their advisory switch off the updater. On Windows, in a command prompt opened as administrator:

1
2

sc.exe stop "Update service"
sc.exe config "Update service" start= disabled

On a Mac, in Terminal with administrator rights:

1

launchctl unload -w /Library/LaunchDaemons/PT.updd.plist

On Android, remove the app, because there the updater cannot be switched off.

If you look after a network, the researchers published the domains and files to hunt for. They also ask security vendors to flag Updater.exe and PT.updd as potentially unwanted programs, so the helper gets caught on machines where the owner forgot it was ever installed.

A program you stopped using can keep running with the highest rights on your computer, asking an address on the internet what to run next. Whoever owns that address decides what your computer does.

Could you open Wireshark on your own computer and see which program calls home over plain HTTP, and what it pulls down?

My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Eye Security: Operation IXIM | Eye Security: CVE-2026-30612 advisory | CVE-2026-30612