Popcorn Time updater flaw exposed millions of devices to hijacking

A security vulnerability in the abandoned Time4Popcorn application, a fork of the BitTorrent streaming service, exposed millions of Windows and macOS devices to potential hijacking. The flaw, tracked as CVE-2026-30612, stemmed from an updater mechanism that trusted unsigned executables delivered over unencrypted HTTP. Because the updater relied on domains that eventually expired, attackers could have registered these domains to distribute malware, such as ransomware or credential stealers, with full system privileges.

Security firm Eye Security conducted ‘Operation IXIM’ between November 2025 and March 2026 to mitigate the risk. After registering the expired domain popcorntimeupd.xyz, the firm observed approximately 50 requests per second. Eye estimates the affected population includes between 2.5 and 3 million Windows hosts and 250,000 to 350,000 Macs. The connections originated from various sources, including home broadband, corporate, government, and military networks.

To prevent a large-scale botnet, Eye Security used the updater to deliver a ‘benevolent update’ designed to disable the vulnerable process. This intervention successfully reduced daily update requests by 98% by March 2026. Researchers noted that the vulnerability does not affect newer projects launched under the Popcorn Time name in early 2025.