Overview
Researchers at Eye Security remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent streaming client. The updater flaw, tracked as CVE-2026-30612, could have let anyone controlling its update domain run code with elevated privileges on millions of computers. Eye called the effort Operation IXIM.
The Flaw
The Windows and macOS updaters contacted an abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without verifying digital signatures.
| Platform | Impact of a hijacked update |
|---|---|
| Windows | Code execution as SYSTEM |
| macOS | Code execution as root |
| Android | User prompted to install an attacker-supplied APK |
Scale
After registering the lapsed domain, Eye observed up to 3 million Windows and 350,000 macOS client connections from residential ISPs as well as corporate, government and military networks. A later analysis found the identifiers cannot reliably represent individual devices, so the true device count is uncertain.
The Takedown
Between November 2025 and March 2026, Eye registered 15 lapsed update domains and used the vulnerable update mechanism itself to deliver a payload that stopped and disabled the updater. On Windows it disabled the service without deleting files. The payload collected no telemetry. More than two million update downloads were delivered, and the domains were then transferred to the Shadowserver Foundation.
The researchers acknowledged the ethical questions of pushing code to machines they do not own, but argued the alternative "was to do nothing" while a malicious actor could have built a botnet.
Still Unsafe
Disabling the updater does not make the app safe. It runs a 2014-era Chromium engine with the sandbox disabled, loads content over HTTP, and pulls JavaScript from abandoned domains. The flaw has no patch because the project is abandoned.
Recommendations
- Uninstall Time4Popcorn and any Popcorn Time fork you cannot trace to an actively maintained source.
- Hunt for the app and its update service on managed endpoints and block its update domains.
- Treat any host that ran it as potentially exposed during the window when the domains were unowned.
- Audit your own software for update channels that use plain HTTP, unsigned payloads, or domains that could lapse.