Millions of Old Popcorn Time Installs Were Hijackable

Here's one of the stranger security stories of the year. A security firm spent months pushing more than 2 million updates to computers it didn't own, all to switch off a forgotten piece of Popcorn Time that could have handed those machines to anyone. I came across it through The Hacker News on X, and the full account is in Eye Security's own Operation IXIM write-up, which it presented at the Hack.lu conference on October 22.

What happened

Popcorn Time was the free app that streamed pirated films over BitTorrent about a decade ago. The original died in 2014, but forks kept the name going. One of them, Time4Popcorn, installed a background program called Updater.exe on Windows (and a helper called PT.updd on Mac) that starts with the computer and checks for new versions.

During a routine threat hunt, Eye Security noticed that updater on a client's laptop calling a domain nobody owned anymore. So it registered the domain to see what would connect. Around 50 requests a second showed up. Over six months it logged more than 3.8 million hardware IDs. Those IDs turned out to be a messy way to count, and the firm now estimates 2.5 to 3 million Windows PCs and 250,000 to 350,000 Macs, per The Hacker News report.

The scary part is how the updater behaved. It fetched updates over plain HTTP, didn't check any signature, and ran whatever it got as SYSTEM on Windows or root on Mac. With the domains abandoned, anyone who bought the right one could have pushed ransomware or password stealers to millions of machines. The bug is now tracked as CVE-2026-30612.

With no developer left to patch it, Eye used the updater against itself. Between November 2025 and March 2026 it served an "update" that only stops and disables the updater. Traffic dropped about 98% by March, and the firm then handed its domains to the non-profit Shadowserver Foundation to keep them out of the wrong hands.

Why it matters

Most of these people installed Popcorn Time years ago and forgot about it, but the updater kept running every time the PC booted. That's the real lesson here. Abandoned software doesn't go quiet, and an expired domain can turn an old app into a backdoor overnight. Eye also says some of the updater's other domains belong to outside owners, so not every machine is covered.

Also, switching off the updater doesn't make the app itself safe. Eye says it runs on a 2014 browser engine with its sandbox turned off and loads content over unencrypted connections.

What to do

• Uninstall Popcorn Time if it's on any computer in your house, including that old family laptop. That's Eye's main advice.
• Can't remove it right away? On Windows, an admin Command Prompt can disable the service with sc.exe config "Update service" start= disabled. On a Mac, run sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist.
• On Android, there's no background updater, but removing the app is still the only real fix.
• While you're at it, check your startup apps for other programs you no longer use.

If you run network-wide DNS filtering like Pi-hole or AdGuard Home, it's also a cheap way to spot old apps on your network that keep calling home to domains you've never heard of.