Abandoned Popcorn Time updater left millions of PCs and Macs open to takeover

Security researchers at Dutch firm Eye Security have revealed that an abandoned fork of the Popcorn Time streaming app left millions of Windows and macOS computers exposed to remote code execution through an insecure updater, and that they used the same mechanism to remotely disable it on more than 2 million devices. The issue, tracked as CVE-2026-30612, was rated 9.8 by CISA, according to The Hacker News, and was presented at the Hack.lu conference on October 22.

What happened

According to BleepingComputer, the Windows and macOS updaters in Time4Popcorn, a fork of the BitTorrent-based Popcorn Time client, kept contacting the abandoned domain popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures. Eye Security discovered the problem during a routine threat hunt and registered the domain, along with 14 more domains associated with the service.

The Hacker News reported that requests carried more than 3.8 million hardware IDs between November 2025 and March 2026, which Eye revised to an estimated 2.5–3 million Windows computers and 250,000–350,000 Macs. Connections came from residential ISPs as well as corporate, government and military networks, although the researchers said it was hard to draw conclusions from that sample.

Technical details

The updater runs in the background from startup with the highest privileges, SYSTEM on Windows and root on macOS. Anyone controlling the update domains could therefore have delivered malicious code to every machine still calling them, with Eye citing ransomware, password theft and botnet enrollment as possible outcomes. Affected versions include Windows builds up to 6.2.1.18, Mac builds up to 6.2.1.17 and Android builds up to 3.5.0.173, according to The Hacker News.

With no vendor patch available, Eye said it took legal advice and, between November 2025 and March 2026, pushed a payload that only stopped and disabled the updater, without deleting files or collecting data. It recorded more than 2 million update downloads, and by March 1, 2026 requests to the domain had fallen by 98%. The domains were then transferred to the nonprofit Shadowserver Foundation. Eye said it found no evidence that anyone else had served code through these addresses.

Who is affected

Android users remain exposed because installing an update requires user interaction, so Eye could not disable the updater remotely. The researchers also warned that the app runs on a 2014 browser engine with its sandbox disabled and pulls code from other abandoned addresses, some of which belong to outside owners.

What to do

• Uninstall Popcorn Time entirely; both publications describe this as the best option.
• Defenders should look for Updater.exe on Windows and PT.updd on macOS, and for traffic to the domains listed in Eye Security's write-up.
• If removal is not immediately possible, the updater service can be disabled manually as described in the researchers' guidance.