Researchers disable vulnerable Popcorn Time updater on millions of devices

Researchers at Eye Security identified that an updater for the abandoned Time4Popcorn application remained active on millions of Windows, macOS, and Android devices worldwide. The updater contacted abandoned web domains over unencrypted HTTP connections and utilized an outdated Chrome browser engine from 2014 that lacked sandbox protections. This configuration allowed attackers to execute code with SYSTEM privileges on Windows and root privileges on macOS. The vulnerability is tracked as CVE-2026-30612 and is rated 9.8 out of 10 by the U.S. Cybersecurity and Infrastructure Security Agency.

To mitigate the risk, Eye Security registered one of the abandoned domains and sent a custom update instructing the updater to disable itself. This remediation payload collected no host data or telemetry and deleted no files on users' computers. The operation, named Operation IXIM, ran between November 2025 and March 2026. During this period, the researchers pushed more than 2 million updates. Observations indicated up to 3 million Windows client connections and 350,000 macOS client connections to the updater before the intervention.

Following the remediation, requests to the update domain dropped by 98%. The researchers compared their effort to Operation Ladybird in 2021. Android users remain exposed because installing an update requires user interaction. The team stopped the operation after achieving the desired reduction in active connections.