Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, Dutch security researchers at Eye Security pushed over 2 million updates to computers they did not own in an effort to disable a background updater that could potentially allow an outsider to take control of the machine. The updater belonged to Time4Popcorn, an abandoned copy of the free app Popcorn Time, which once streamed pirated movies and TV shows over BitTorrent.

Popcorn Time was popular a decade ago, with the original shutting down in 2014, but several copies continued to run under the same name. Eye Security discovered the updater during a routine threat hunt, noticing a program called Updater.exe on a client's laptop repeatedly attempting to reach an unregistered web address. The researchers registered the address themselves to track the incoming requests and found over 3.8 million distinct hardware IDs, which they later revised to approximately 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs.

The updater ran continuously in the background, checking for updates over an unencrypted connection and installing whatever was sent to it at the highest privilege level, posing a significant security risk. Eye Security notified the U.S. Cybersecurity and Infrastructure Security Agency about the vulnerability, which was tracked as CVE-2026-30612, and received a rating of 9.8 out of 10.

Despite no patch being available, Eye Security decided to utilize the updater against itself, sending a disabling update that stopped the updater without deleting any files. The firm compared this action to Operation Ladybird in 2021, where Dutch police pushed an update to computers infected with the Emotet botnet to disable the malware.

However, unlike the Emotet case, Popcorn Time users willingly installed the app, including the potentially dangerous updater. After the updates began, the traffic to the web addresses was reduced by about 90 percent within a few months. Eye Security handed over the control of the 15 web addresses it used to the Shadowserver Foundation, a non-profit organization that takes abandoned and malicious domains offline, ensuring they would not be used for malicious purposes.

Despite these efforts, the flawed Popcorn Time app remains dangerous, requiring users to uninstall it or manually disable the updater to fully mitigate the risks.