Popcorn Time: the forgotten app that could have controlled millions of PCs
Remember Popcorn Time, the app that let you stream pirated movies in one click? It was abandoned years ago. Yet its updater was still running on millions of computers, with the highest privileges, ready to install whatever it was sent.
Researchers at Eye Security found it while investigating one of their client’s laptops. Rather than let those machines become a huge zombie network, they pushed over 2 million updates that disable the updater. They presented the operation, called IXIM, on October 22 at the Hack.lu conference. For a small business, the real question is elsewhere: what forgotten software is sleeping on your work computers?
Popcorn Time: the service still quietly running
Here’s what it looks like on a Windows laptop, in the services list:
What the technician notices
1A vaguely named service, no description, starting by itself with the highest privileges (SYSTEM). It’s Popcorn Time’s updater (Updater.exe), installed years ago and forgotten. The employee no longer opens the app, but this service runs at every startup.
The program regularly asked whether a new version was available, over unencrypted HTTP, and installed whatever it received without checking a signature. The domain names it contacted were no longer maintained: anyone who bought them could run anything on every computer that still had it. The flaw is tracked as CVE-2026-30612.
Operation IXIM by the numbers
2 million+
downloads of the update that disables the updater, from November 2025 to March 2026
3.8 million+
distinct hardware IDs observed by the researchers
≈ 50 / s
update requests received every second at the start
98%
drop in traffic by March 1, 2026, still about 5,000 updates a day
The researchers estimate that 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs were affected. Their update deleted no files and collected no data: it only stopped and disabled the updater. Traffic had already dropped 90% by December 2025.
Why this is a small-business problem, not just a pirate one
A work computer on which someone once installed a “home” app is common: a laptop lent to a child, a former employee, a second-hand machine. The software is forgotten, but it keeps its access. We saw the same pattern with hijacked remote access tools and with the Plex vulnerability on media servers: what has no owner gets updated by no one.
Disabled or uninstalled: not the same thing
| Disabled by Eye Security’s update | Uninstalled | |
|---|---|---|
| Updater | Stopped and disabled | Removed |
| App and its old Chrome engine | Still there | Removed |
| Domains still held by third parties | The computer no longer contacts them if it got the update | No risk |
| Android version (≤ 3.5.0.173) | Can’t be fixed remotely | Removed |
| Unauthorized piracy software on a work computer | Still there | Removed: the acceptable-use question still needs addressing |
If one of your computers received Eye Security’s update, its updater is neutralized. But the app and its 2014 Chrome engine, with no sandbox, are still there. On Android, nothing can be fixed remotely. Uninstall it.
Tuesday morning, 20 minutes
The forgotten-software cleanup
- Export the list of installed software on each laptop (Settings ➜ Apps, or your management console).
- Look for Popcorn Time, Time4Popcorn or an “Update service” /
PT.upddservice: Windows versions up to 6.2.1.18, Mac up to 6.2.1.17. - Uninstall any software that has no owner or no reason to be at work.
- Remove administrator rights from everyday accounts to block unapproved installs.
- Write a short list of allowed software and review it every quarter.
If you can’t uninstall right away: sc.exe stop "Update service" then sc.exe config "Update service" start= disabled (Windows, as administrator) or sudo launchctl unload -w /Library/LaunchDaemons/PT.updd.plist (Mac).
Frequently asked questions
Q1. Our antivirus flagged nothing. Are we in the clear?
Not necessarily. Popcorn Time isn’t a virus: it’s a real, abandoned app whose updater did exactly what it was built to do. Ironically, antivirus tools flagged the first version of Eye Security’s own update, which the researchers had to rework. Only an inventory of installed software answers the question.
Q2. Is the danger over now that the researchers disabled everything?
Largely, for the updater: 15 domains were transferred to the Shadowserver Foundation in late March. But other domains belong to third parties, some computers never connected during the operation, and the app itself remains vulnerable. The only real fix is uninstalling it.
Q3. What is CVE-2026-30612?
It’s the number assigned to the flaw in Popcorn Time’s updater (unencrypted, unsigned updates run with the highest privileges), rated 9.8 out of 10 by CISA. As of October 23, it wasn’t in the catalog of exploited vulnerabilities.
Q4. How do we avoid the next Popcorn Time?
It won’t necessarily be a movie app: an old driver utility, a free PDF reader or a toolbar can have the same kind of updater. The two good habits are a regular software inventory and everyday accounts without administrator rights.
At NeoTech, our IT support and help desk keeps an inventory of the software on your computers and removes what doesn’t belong there, and our cybersecurity services manage administrator rights. With our cyber monitoring, automated 24/7 monitoring with on-call technician response spots unknown services starting with your computers.
Book your free cyber check
Not sure exactly what’s installed on your team’s laptops? The free cyber check includes a look at your workstations, forgotten software and administrator rights, with a clear plan at the end.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Eye Security: Operation IXIM, Preventing a Botnet of Millions of Popcorn Time Users (October 2026)
- BleepingComputer: Abandoned Popcorn Time app exposed millions of devices to RCE attacks (October 23, 2026)
- The Hacker News: Researchers Push Over 2 Million Updates to Disable Popcorn Time’s Abandoned Updater (October 24, 2026)
- The Verge: Popcorn Time piracy botnet avoided (October 2026)
Photo: Arina Krasnikova, Pexels (Pexels licence).
One thought on “Popcorn Time: the forgotten app that could have controlled millions of PCs”