Eye Security disables abandoned Time4Popcorn updater (CVE-2026-30612, Operation IXIM) that exposed millions of PCs and Macs to RCE

Linha do tempo

1. malwarebytes.com ↗ · pub. 26/10/2026 10:48 · coletado 01/11 22:21

   Abandoned Time4Popcorn updater (CVE-2026-30612) exposed millions of Windows and Mac devices to RCE; Eye Security neutralized it

   ler a análise desta fonte ocultar

   Researchers at Eye Security disabled an abandoned update mechanism in Time4Popcorn, a fork of the Popcorn Time streaming app, that could have let attackers take over Windows and macOS machines silently. The updater used unencrypted HTTP and accepted executable updates without signature verification, and the associated domains had lapsed and become available for registration. Eye Security estimates 2.5–3 million Windows and 250,000–350,000 Mac devices were affected. The flaw is tracked as CVE-2026-30612.

   Technical Details

   • The updater fetched updates over HTTP and did not verify digital signatures, so anyone controlling an update domain or able to tamper with traffic could deliver an arbitrary executable (remote code execution).
   • Windows and macOS were silently exploitable in the background, even if the app had not been opened in years. On Android, the updater checked at app launch and installing an attacker APK required user approval.
   • Eye Security registered an abandoned update domain and pushed an update that disabled the updater: on Windows it stopped and disabled the service, on macOS it prevented the update process from starting. It says it did not delete files or collect host data.
   • By March 2026 there were over 2 million downloads of the fix and update requests to its domains fell by 98%. It transferred the 15 domains it controlled to the Shadowserver Foundation.
   • The Android updater could not be remotely disabled. The desktop app still has other weaknesses, including an obsolete 2014 Chrome engine and disabled sandbox protections.
   • Windows component: Updater.exe in a Popcorn Time folder under Program Files, running as the service "Update Service". macOS: /Library/PrivilegedHelperTools/PT.updd with launch daemon /Library/LaunchDaemons/PT.updd.plist.

   Remediation

   • Check for Popcorn Time or Time4Popcorn installs and remove them; there is no vendor patch for the abandoned software.
   • Verify the background updater is no longer running on Windows and macOS; Eye Security's advisory has disabling instructions.
   • On Android, uninstall the app rather than accepting its update prompts.
   • Use up-to-date real-time anti-malware protection.
2. securityweek.com ↗ · pub. 27/10/2026 06:44 · coletado 27/10 07:00

   Eye Security sinkholes abandoned Popcorn Time fork updater (CVE-2026-30612) exposing millions of systems to takeover

   SecurityWeek adds that fewer than 200,000 Android devices connect, that the fix reached roughly 2 million Windows and macOS systems, and that Eye's proof of concept executes calc.exe via JavaScript. It also notes that Shadowserver took over the domains in late March and that other domains the app loads JavaScript from are also sinkholed.

   ler a análise desta fonte ocultar

   SecurityWeek adds that fewer than 200,000 Android devices connect, that the fix reached roughly 2 million Windows and macOS systems, and that Eye's proof of concept executes calc.exe via JavaScript. It also notes that Shadowserver took over the domains in late March and that other domains the app loads JavaScript from are also sinkholed.

   Eye Security disabled the update mechanism of Time4Popcorn, an abandoned fork distributed as Popcorn Time, and sinkholed its domains. The updater fetched and ran executables over plain HTTP with no code signing, so anyone controlling an update domain could execute code as System/root. The flaw is tracked as CVE-2026-30612. After registering the abandoned domain popcorntimeupd.xyz, Eye saw millions of systems connect: 2.5-3 million Windows, 250,000-350,000 macOS and fewer than 200,000 Android, including clients on government, military and corporate networks. The Shadowserver Foundation took over the domains in late March 2026.

   Technical Details

   • The updater runs in the background at boot, uses HTTP, has no code signing, and downloads and runs any executable the domain supplies.
   • Many update domains were abandoned and others were parked by third parties. Eye registered 15 that were not owned by third parties.
   • Eye began the operation in November 2025 and by March 2026 had served the fix to roughly 2 million Windows and macOS systems, cutting update requests to its domains by 98%.
   • Android was not fixed: the update needs user interaction and the updater is built into the app and cannot be disabled independently.
   • The app is built on a 2014 version of Chrome with no sandbox. Eye built a proof of concept that executes calc.exe via JavaScript. Its update only disabled the updater, so the other risks remain.

   Remediation

   • Uninstall Popcorn Time / Time4Popcorn from all systems; Eye's advice is simply to remove it.
   • The updater can be disabled manually, but the outdated, unsandboxed application should still be removed.
3. thehackernews.com ↗ · pub. 24/10/2026 06:04 · coletado 24/10 09:00

   Eye Security pushes 2M+ updates to disable abandoned Time4Popcorn updater (CVE-2026-30612, Operation IXIM) used by millions of PCs

   Adds the operation name (Operation IXIM) and Hack.lu talk of October 22, the CISA 9.8 rating, affected versions including Android, the revised victim estimates (2.5-3M Windows, 250-350k Macs from 3.8M hardware IDs), the rollout timeline (1M by December 2025, 90% then 98% traffic reduction), the 15 domains handed to Shadowserver while others remain with third parties, the lack of KEV listing and of evidence of third-party abuse, and manual disable commands.

   ler a análise desta fonte ocultar

   Adds the operation name (Operation IXIM) and Hack.lu talk of October 22, the CISA 9.8 rating, affected versions including Android, the revised victim estimates (2.5-3M Windows, 250-350k Macs from 3.8M hardware IDs), the rollout timeline (1M by December 2025, 90% then 98% traffic reduction), the 15 domains handed to Shadowserver while others remain with third parties, the lack of KEV listing and of evidence of third-party abuse, and manual disable commands.

   Eye Security disclosed Operation IXIM, in which it pushed more than 2 million updates between November 2025 and March 2026 to disable the vulnerable background updater of Time4Popcorn, an abandoned Popcorn Time fork. The flaw, CVE-2026-30612 (CISA rating 9.8), let anyone who registered the abandoned update domains serve code to every calling machine, running as SYSTEM or root. Eye found the issue during a threat hunt, registered the lapsed domain and saw about 50 requests per second from more than 3.8 million hardware IDs, which it revised to 2.5-3 million Windows PCs and 250,000-350,000 Macs. It cut traffic by about 98% and handed the 15 domains it controlled to the Shadowserver Foundation in March 2026, but other domains the updater calls remain with outside owners. The findings were presented at Hack.lu on October 22, and the flaw is not in CISA's KEV catalog as of October 23, 2026.

   Technical Details

   • The updater (Updater.exe on Windows, PT.updd on Mac) starts at boot, checks for new versions over unencrypted HTTP and installs whatever it receives as SYSTEM (Windows) or root (Mac) without verifying the sender.
   • Affected versions: Windows up to 6.2.1.18, Mac up to 6.2.1.17, Android up to 3.5.0.173.
   • Eye's update only stops and disables the updater, deleting no files and collecting no data. After it was uploaded to VirusTotal and flagged as malware, Eye reworked it until only one scanner flagged it.
   • By December 2025 more than 1 million systems were updated and traffic fell about 90%. By March 1 it was about 5,000 updates per day (98% reduction), and Eye stopped.
   • Eye found no sign that anyone else served code through the domains; those registered by others were parked or for sale.
   • The app itself remains dangerous: it uses a 2014 browser engine with the sandbox disabled, loads content over unencrypted connections and pulls code from other abandoned domains. Eye registered some of them and built a working proof of concept.
   • Android: the updater is built in, cannot be disabled separately and installs only on user acceptance, so no updates were sent.
   • Eye compared the action to the 2021 Operation Ladybird against Emotet and took legal advice first.
   • One domain, popcorntimeupd[.]xyz, now points to Shadowserver sinkholes (transfer dated March 20, 2026).

   Remediation

   • Uninstall Popcorn Time/Time4Popcorn, the only fix on Android.
   • Manual disable on Windows: sc.exe stop "Update service" and sc.exe config "Update service" start= disabled. On Mac: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist.
   • Hunt for Updater.exe and PT.updd and for traffic to the domains and hashes listed in Eye's write-up (20 domains).
4. bleepingcomputer.com ↗ · pub. 23/10/2026 17:55 · coletado 23/10 18:00 primeiro registro

   Eye Security remotely disables vulnerable Time4Popcorn updater (CVE-2026-30612) exposing millions of devices to RCE

   ler a análise desta fonte ocultar

   Researchers at Eye Security neutralized a flaw in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, that let whoever controlled the update domain execute code with elevated privileges. The flaw, tracked as CVE-2026-30612, affects the Windows and macOS updaters. After registering the lapsed domain popcorntimeupd.xyz, Eye observed up to 3 million Windows and 350,000 macOS client connections, including from corporate, government and military networks. Between November 2025 and March 2026 the researchers used the update mechanism itself to push a remediation payload that disabled the updater. Domain ownership was then handed to The Shadowserver Foundation. Residual risk remains, notably for Android users.

   Technical Details

   • The updaters contacted popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures.
   • An attacker controlling the domain or manipulating the HTTP traffic could achieve code execution as SYSTEM on Windows and as root on macOS.
   • Eye registered 14 additional domains tied to the service. Its payload collected no host data or telemetry and deleted no files. It had to be modified during testing to evade antivirus products that flagged it for disabling a service.
   • After remediation, Eye recorded 2 million update downloads, and requests to the update domain dropped by 98% by March 1.
   • Connections appeared to come from installed-and-forgotten instances, with no active use.
   • Android users remain exposed because updating requires user interaction and the updater could not be disabled remotely.
   • The app also embeds a severely outdated 2014 Chrome engine with no sandbox, which could be exploited.

   Remediation

   • Uninstall Time4Popcorn from all systems, including Android devices.
   • Hunt for the app on corporate, government and military endpoints and for traffic to popcorntimeupd.xyz.