An abandoned Popcorn Time updater left millions of Windows and Mac computers open to remote takeovers, according to researchers who found machines still calling dead update servers years after users installed the old torrent client. That pattern mirrors earlier cases where malware hid inside pirated Mac apps long after anyone meant to keep using them.
Between November 2025 and March 2026, the team at Eye Security registered those domains, reverse engineered the update protocol, and pushed a one-time fix that shut the updater down. They presented the work, called Operation IXIM, at the hack.lu conference on October 22. The flaw later received CVE-2026-30612.
The software in question is Time4Popcorn, a closed-source fork that kept shipping under the Popcorn Time name after the original project shut down in 2014. A separate legal streaming project that began using the Popcorn Time name in early 2025 is not part of this research.
Eye Research first noticed a process called Updater.exe on a client laptop trying to reach popcorntimeupd.xyz, a domain that was no longer registered. After taking over the name, the team watched about 50 requests per second roll in. Over six months they logged more than 3.8 million hardware IDs. Revised counts put the real footprint at roughly 2.5 to 3.0 million Windows hosts and about 250,000 to 350,000 Macs, with Android under 5 per cent.
The old apps checked for updates over an unsecured connection, so an attacker could swap in a fake update. On Windows, that fake update could install malware with full control of the PC. On a Mac, it could take over the computer every time it started up. Many people have likely forgotten the app is still on their computer.
That kind of background foothold is exactly what ransomware crews and password stealers look for when they want a way onto home machines that also touch work accounts. It sits alongside other Mac risks we have covered, from Spotlight plugins that bypass privacy prompts to malicious apps that scrape wallet recovery phrases.
Because the original distributors were long gone and had already lost the update domains, there was no vendor patch on the way. Eye Research chose to serve a narrowly scoped update of its own. On Windows it stopped and disabled the “Update service.” On Mac it unloaded the PT.updd launch daemon. The payload did not delete files or collect telemetry. By March 1, 2026, daily update traffic was down about 98 per cent, after more than 2 million update downloads. The team later handed 15 of the domains to The Shadowserver Foundation.
Android clients were left alone. Those apps only check for updates when opened, and installing a replacement APK needs a tap from the user.
Disabling the updater does not make the rest of the old client safe. Researchers say the app still runs on a 2014 Chrome engine with the sandbox turned off, still talks over HTTP, and still loads JavaScript from domains that had also been abandoned. Their advice is simple: uninstall it. Endpoint vendors are also being asked to flag Updater.exe on Windows and PT.updd on macOS as potentially unwanted.
Did you ever leave an old Popcorn Time install sitting on a Mac or PC, and will this change how you clear out forgotten apps?
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
