Popcorn Time: The Zombie Army of Abandoned Devices That Almost Became a Botnet
Between 2014 and today, an outdated version of an app that once revolutionized torrent-based streaming and disappeared from app stores continued running silently on millions of computers, passively waiting for someone to control its defective update mechanism. What happened to Popcorn Time since its disappearance — and why a team of security researchers had to take such drastic measures to disable it — is a fascinating portrait of what happens to abandoned software when no one takes responsibility.
What Popcorn Time Was and Why It Disappeared
Popcorn Time was born in 2014 as the "Netflix for piracy": an application that combined the clean, intuitive interface of streaming services with the BitTorrent infrastructure to instantly download and display movies and TV shows. It gained millions of fans for democratizing content access — and millions of legal problems for distributing that content without licenses. By mid-2014, the original project was discontinued under legal pressure, but the name and concept lived on through forks and clones.
One of these forks, Time4Popcorn, continued to be distributed as if it were the original, using the same name and logo. The original project had been discontinued years earlier, but versions like Time4Popcorn (running on Windows, macOS, and Android) were still downloaded and installed, often by users who had no idea they were running abandoned software.
The Discovery: Updater.exe on a Forgotten Laptop
It all started with a routine threat hunt. Researchers at Eye Security, a managed security services provider, noticed a process called "Updater.exe" running on a client's laptop. The process was attempting to connect to a domain that no longer existed: popcorntimeupd.xyz. It was obvious that this was the update mechanism from some fork of Popcorn Time.
What the researchers discovered next was staggering. The abandoned domain popcorntimeupd.xyz, left unused for years, was still receiving constant requests from computers around the world. To understand the scope of the problem, the researchers registered the domain and watched. Over six months, they collected more than 3.8 million unique hardware IDs — indicating 3.8 million devices with the software installed and active. Half running Windows, approximately 45% macOS, and less than 5% Android.
The Vulnerability: CVE-2026-30612
The core problem was the Updater.exe (Windows) and PT.updd (macOS) processes. Both ran with elevated privileges — as a SYSTEM service on Windows and as root on macOS — and communicated with the update server over unencrypted HTTP, with no digital signature verification whatsoever. Anyone who controlled the update server could send any executable file and it would run with full privileges on the device.
In an attack scenario, this meant a ransomware operator could use Popcorn Time as an entry point into corporate, government, and even military networks. Passwords stored on the device, credentials for accessing corporate systems — all at risk. The impact would be severe, and the Eye Security researchers themselves warned: "If we were able to send an update, we could get code execution on millions of systems."
Operation IXIM: When Research Becomes Action
Instead of simply publishing a CVE and hoping someone would take action — which is the normal protocol — the Eye Security team made an extraordinary decision: take control of the update server and, instead of delivering malware, remotely disable the update mechanism on all connected devices.
Between November 2025 and March 2026, Eye Research executed Operation IXIM: they registered the abandoned domains, intercepted the update requests, and instead of delivering malicious code, sent a removal script that stopped the Updater.exe service (Windows) and disabled PT.updd (macOS). The process was silent and invisible to the user — the abandoned software simply stopped working.
The early days were cautious. Researchers served only hardware IDs they had already seen, once each, and redirected clients to HTTPS whenever possible. After a few weeks, they relaxed those limits to reach more systems. In total, more than two million remediation updates were downloaded.
The reaction was immediate. A week later, 11 antivirus vendors were already detecting Eye's update as malware — which is not surprising, since the script actually stopped operating system services and modified processes with root privileges. VirusTotal summed it up: "The malware targets and disables a Windows service named 'Update service'."
What This Tells Us About Software's Future
The story of Popcorn Time and Operation IXIM raises a question that the technology industry has been ignoring for years: what happens to millions of devices when software is abandoned without a sunset plan?
The original Popcorn Time was discontinued over a decade ago. Its forks continue to live on computers of users who don't know they're running insecure software. The update mechanism, which was supposed to keep the software current, ultimately became a massive risk vector — literally a "run any code" button delivered to the door of millions of machines.
The case also shows a new pattern of behavior in cybersecurity. When the Eye Security team realized the abandoned domain was a risk, they didn't wait for attackers to exploit it first. Instead of publishing an advisory and hoping someone would do something, they assumed the risk of executing code on third-party devices — which, ironically, was safer than leaving the Updater.exe running.
The cybersecurity industry has long operated under the assumption that publishing a CVE and expecting vendors to fix the problem was sufficient. Operation IXIM proves that when software is dead and no one maintains it anymore, responsibility falls on whoever has the knowledge and technical capability to act. And if Popcorn Time isn't the only case like this? How many other obsolete programs are running silently on millions of devices, waiting for a malicious actor to take control of their update server?
Sources: The Verge, Eye Security Research, BleepingComputer
✓ Independent sources cross-checked and verified before publishing
