Eye Security says it remotely disabled an abandoned Time4Popcorn updater between November 2025 and March 2026. Its October 22 account of Operation IXIM describes software that kept requesting privileged updates long after users stopped opening the app.

Time4Popcorn is an older fork distributed under the Popcorn Time name. Eye explicitly excludes the new project using that name since 2025. The problem is CVE-2026-30612, first described in Eye’s June 11 advisory. October’s publication explains the intervention; it is not a new vulnerability disclosure or patch release.

The updater trusted whoever controlled its delivery path

The Windows and macOS updaters fetched updates over unencrypted HTTP without verifying executable signatures. An attacker controlling an update domain or able to alter that traffic could supply code running as SYSTEM on Windows or root on macOS.

Both desktop updaters started automatically and operated without user interaction. On Android, the app checked when opened and prompted the user to install an update. That user-interaction requirement changes the exposure, but leaves the insecure delivery path.

Eye registered abandoned domains and reverse-engineered the update process. It then delivered code that stopped and disabled the desktop updater. The company says that code collected no host telemetry and deleted no files. It transferred its 15 domains to the Shadowserver Foundation in late March; some other update domains remained outside its control.

Evidence status: researcher-reported real-world remediation using the vulnerable update mechanism. The reviewed sources do not establish a criminal campaign compromising millions of devices. Bill Toulas’s October 23 reporting covers the operation, principally from Eye’s findings.

Connection counts need qualification

Eye initially counted more than 3.8 million purported device identifiers. Its investigation found Windows identifiers shared across machines and macOS identifiers that could change on the same machine.

Its revised estimates are 2.5–3 million Windows hosts and 250,000–350,000 macOS hosts. These are estimates of observed clients, not verified compromise totals. Eye reports more than two million update downloads and a 98% reduction in update requests by March 1. Downloads and disappearing requests do not prove that every affected device was repaired.

Remove the abandoned app, including its background component

Eye says no vendor update is available and recommends removing the software completely. A disabled updater leaves the main application unchanged. Researchers found a 2014 Chrome engine with its sandbox disabled, unencrypted content loading and abandoned JavaScript-hosting domains.

  • Identify the fork before acting. This advisory concerns old Time4Popcorn installations, not every project called Popcorn Time.
  • Remove the abandoned application and verify its updater is gone or disabled. Eye’s advisory identifies the Windows Updater.exe service and macOS PT.updd helper, with platform-specific locations and disabling guidance.
  • Use existing software inventories and endpoint records to find forgotten copies. Eye publishes file hashes and domain indicators; an updater connection alone is evidence of installed software, not proof of malicious access.
  • On Android, remove the old app. Its updater is embedded in the application and was outside Eye’s remote remediation.

The operation also exposes a difficult consent question: a security company executed code on other people’s computers to remove a hazard. Eye describes legal consultation and testing. That account is not a general authorization for third parties to repeat the intervention.

Caveat: Eye sells managed security services and carried out the operation it describes; its reach and remediation figures remain company-reported estimates.