Security Firm Disables Popcorn Time Updater to Prevent Botnet Hijacking
Dutch firm Eye Security proactively disabled a dormant Popcorn Time updater on millions of devices, preventing its potential exploitation for botnet creation or data theft.
In an unusual proactive cybersecurity measure, Dutch security firm Eye Security has successfully disabled a dormant background updater component of the abandoned Popcorn Time streaming application across an estimated 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. The operation, dubbed Operation IXIM, aimed to neutralize a significant vulnerability that could have allowed attackers to remotely hijack affected machines and enlist them into botnets.
The vulnerable updater, Updater.exe, was part of an abandoned copy of Popcorn Time, a peer-to-peer application for streaming pirated movies and TV shows that gained popularity over a decade ago. While the original Popcorn Time project ceased operations in 2014, various forks and copies persisted. Eye Security discovered the updater during a routine threat hunt when it observed the program attempting to connect to an unregistered web address. By registering the domain themselves, the firm found that millions of devices were still actively seeking updates.
Analysis revealed that the updater communicated over an unencrypted connection and installed any provided payload with the highest system privileges (SYSTEM on Windows, root on Mac) without any validation. This design flaw meant that any entity gaining control of the updater's communication endpoint could have delivered malicious software, such as ransomware, stolen credentials, or malware to establish botnet control, to a vast number of unsuspecting users. The firm observed connection requests originating from home users, as well as from government, military, and corporate networks globally.
The vulnerability, now tracked as CVE-2026-30612, affects specific versions of the Time4Popcorn software for Windows, Mac, and Android. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has assigned it a critical severity score of 9.8 out of 10. Given that the original developers are no longer active, a traditional patch was not feasible.
Eye Security, after consulting legal counsel, decided to leverage the updater's own mechanism against it. They developed and distributed an update that, when installed by the vulnerable updater, simply disables and removes itself, thereby neutralizing the threat. This approach mirrors past operations like "Operation Ladybird" where law enforcement disabled botnet infrastructure.
Initially, antivirus software flagged Eye Security's disabling update as malware, as it interfered with a system service. The firm iteratively refined the update to bypass detection by most security products, ensuring its effectiveness without being blocked. By March 2026, the firm reported a 98% reduction in traffic to its controlled domains, indicating the success of their operation in disabling the updater on millions of systems.
Following the operation, Eye Security transferred control of the 15 web addresses it managed to the Shadowserver Foundation, a non-profit organization dedicated to managing abandoned and malicious domains. This ensures that these domains are properly sinkholed and cannot be re-registered by malicious actors. However, the firm noted that some updater communication endpoints remain under the control of third parties and are still exposed.
Eye Security emphasizes that disabling the updater does not make the Popcorn Time application itself safe. The app still relies on outdated components, lacks a security sandbox, and uses unencrypted connections for content delivery. Users are strongly advised to uninstall Popcorn Time entirely to mitigate remaining risks, as disabling the updater alone leaves the application vulnerable.