Eye Security Pushed 2 Million Unrequested Updates to Kill an Abandoned Popcorn Time Updater. It Was the Right Call.

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own. Each one did a single thing: it switched off a forgotten background updater that, by Eye's account, would have given any outsider SYSTEM or root control of the machine. No vendor asked for this and no owner agreed to it. By Eye's estimate, 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs were still calling home to dead web addresses when the firm stepped in.

The software is Time4Popcorn, an abandoned copy of Popcorn Time, the BitTorrent app for streaming pirated films and TV that peaked about a decade ago. The original shut down in 2014, but copies kept running under the same name. A separate, legal project that took the Popcorn Time name in early 2025 has nothing to do with it. Eye described the work, which it calls Operation IXIM, in a write-up and a talk at Hack.lu on October 22, as reported by The Hacker News.

A dead domain, 50 requests a second

It started as a routine threat hunt. A program called Updater.exe on one client's laptop kept trying to reach a web address that was no longer registered. Eye registered the address itself to see what would connect, and about 50 requests a second came in. Over six months those requests carried more than 3.8 million distinct hardware IDs. Eye later revised that count because some Windows PCs shared an ID and some Macs kept changing theirs.

The design flaw is a textbook case. The updater started at boot on Windows and Mac, checked for new versions over an unencrypted connection, and installed whatever it was sent at the highest privilege level without checking who sent it. Once the update domains lapsed, anyone who registered the right one could ship code to every machine still asking. Eye said that put ransomware, password theft and botnet enrollment within reach. A sample of the connecting addresses showed home users around the world, plus machines on government, military and corporate networks, though Eye cautioned that it is "hard to draw conclusions" from that.

Turning the updater against itself

With nobody left to patch the software, Eye got legal advice and then used the flaw as the fix. It served an update that stops and disables the updater. The update deletes no files and collects nothing. Eye compared the step to Operation Ladybird in 2021, when Dutch police pushed an update that disabled Emotet on infected computers. Eye pointed to one difference: Emotet's victims never chose to be infected, while Popcorn Time's users installed the app themselves. Still, as the firm put it, "none of them chose to have a forgotten updater running in the background for years."

Then security tooling got in the way. Someone uploaded Eye's update to VirusTotal, and antivirus engines started flagging it as malware. That is a fair label for code that disables a Windows service. But every product that blocked the update left the vulnerable updater running. Eye reworked the payload until only one scanner still flagged it.

By December 2025, Eye had updated more than 1 million systems and cut traffic to its domains by about 90 percent. By March 1, it was sending about 5,000 updates a day, a 98 percent reduction. Eye judged the remaining numbers too small to interest a botnet operator and stopped, after more than 2 million update downloads in total. In late March it handed the 15 domains it controlled to the Shadowserver Foundation. Registration records for popcorntimeupd[.]xyz now point to Shadowserver's sinkhole servers, with a transfer dated March 20, 2026.

The RedEye take

Eye made the right call, and the way it carried out the operation is a model for others. It got legal advice first, used a payload that did the minimum, collected no telemetry, gave a public account, and finished by placing the domains with a neutral non-profit instead of keeping them. That last step matters most. A private company that holds the update channel for millions of machines is a risk in its own right, however good its intentions.

The bigger story is that it fell to a private firm at all. There was no vendor, no patch, no KEV listing and no agency pushing a fix. A 9.8 flaw stayed open on millions of endpoints, some of them on government and military networks, and the only party willing to act had to take on its own legal risk. Unauthorized remediation should not be the industry's default safety net for abandoned software. Until there is a clear framework for who may act on orphaned update channels, the next researcher who finds one must choose between doing nothing and doing something legally uncomfortable. Many will do nothing, and someone less careful will register the domain.

The antivirus episode matters too. Detection engines flagged the fix as malware and, in doing so, kept machines vulnerable. That is not a scandal, because the flags were technically accurate. It is a reminder that a signature verdict knows nothing about intent.

What defenders should learn

• Treat beacons to unregistered domains as a finding, not noise. This whole operation began with one laptop calling a dead address. Persistent processes that keep failing to reach a domain point straight at the abandoned update channels an attacker would buy.
• Inventory services, not just applications. The danger here was a boot-time SYSTEM and root service left behind by software nobody maintains. Asset reviews should flag persistent updaters tied to unsupported products, including software users installed themselves.
• Do not wait for KEV to set priorities. CVE-2026-30612 is rated 9.8, has no patch, and is not in KEV. For abandoned software, a lack of evidence of exploitation says nothing about how cheap exploitation would be. Here it took one domain registration.
• Decide ahead of time how you handle good-faith remediation. If a payload like Eye's reaches your fleet and your endpoint tooling blocks it, your tooling may be what keeps a vulnerable component running. Know who reviews these detections before an automatic quarantine becomes permanent.
• Partial cleanup is not cleanup. Disabling the updater left a 2014 browser engine with no sandbox in place. For orphaned software, the only acceptable outcome is removing the whole application, not mitigating one component.

Source: The Hacker News, "Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet," October 24, 2026.