Eye Security registered Popcorn Time's abandoned update domain, found millions of machines ready to run anything it sent, and pushed one update that only switched the updater off
A closed-source Popcorn Time fork kept polling update domains nobody owned, over plain HTTP with no code signing, ready to run whatever came back as SYSTEM or root. Defenders got there first.
It started with a routine threat hunt. A process on a customer machine “was attempting to connect to a domain that wasn’t registered anymore,” Niels Teusink writes in Eye’s write-up, presented at hack.lu in Luxembourg on October 22. The process was Updater.exe, from Time4Popcorn, a closed-source fork of Popcorn Time, the torrent-streaming app whose original team quit in 2014. On a Mac the same job falls to PT.updd.
The updater’s whole protocol was trust. “There was no code signing and this process was all happening over HTTP.” Hand it a link to an executable and it would download it and run it “with high privileges (NT AUTHORITY\SYSTEM).” One of its domains, popcorntimeupd.xyz, had lapsed. The others “all seemed to be claimed by bulk domain buyers,” parked or for sale for thousands of dollars.
Eye registered the free one and started counting. “Over the next six months, we saw over 3.8 million of these IDs.” That number shrank once the team realized hardware IDs repeat across cloned machines, and the revised estimate is “about 2.5-3.0 million hosts” on Windows and “250-350k” Macs. “None of our clients were actively using the software,” Teusink adds. The app was just sitting there, installed and forgotten, polling.
As BleepingComputer put Eye’s own conclusion: “If we were able to send an update, we could potentially get code execution on millions of systems.” The flaw now carries CVE-2026-30612.
Nobody was left to report it to. “Even if we could contact them, what were they going to do about it?” So Eye, with a legal team that “enjoys a good challenge,” wrote the smallest possible fix and sent it through the open door. It stops and disables the update service. “That’s all it does, so no telemetry, no file deletion, nothing.” On macOS it unloads the launch daemon. The model was Operation Ladybird, “where the Dutch police deployed a software update to clients that were part of the Emotet botnet.”
Antivirus didn’t love it. “A week later 11 different vendors were detecting our update as malicious,” and the team reworked it until one vendor still flagged it. By December 2025 it had reached “more than a million systems.” Requests fell about 90% within weeks, and by March 1, 2026 the team was “still sending about 5000 updates per day.” Late that month Eye “transferred the 15 domains we owned to The Shadowserver Foundation.”
Android was never part of the fix, because the Android app has no background updater to switch off. It’s still running a browser engine from 2014, and those users are still out there.
Every abandoned app with an auto-updater is a standing offer to whoever registers its domain next. The machines that took it here weren’t run by careless people; nobody at Eye’s clients was even using the program. Software that was installed once, a decade ago, for one movie, keeps a privileged service running, polling a name that can be bought at retail.
What’s unusual is who answered. Most lapsed update domains get noticed by the wrong side, or by nobody. Here a security firm spotted it in a threat hunt, bought it, counted the damage it didn’t do, and shut it down with an update so small that its own description is three negatives. Then it handed the domains to a nonprofit that sinkholes things for a living, so they can’t drift back to a bulk buyer.