Bug Bounty

Researchers pushed 2m updates to disable Popcorn Time updater

Eye Security disabled a root-level Popcorn Time updater on millions of PCs it did not own. Would UK hacking law allow it?

Scales of justice graphic with the headline Researchers switch off Popcorn Time updater

Dutch security firm Eye Security has revealed that it quietly pushed more than two million updates to machines that were not its own, switching off a dangerous updater left behind by an abandoned Popcorn Time fork. The clean-up probably prevented a ready-made botnet, but it also shows how far ahead of UK hacking law this kind of researcher action now sits.

What happened

On 22 October 2026, Eye Security’s research team published the full story of what it calls Operation IXIM, the same day principal researcher Niels Teusink presented it at the Hack.lu conference in Luxembourg. It began with a routine threat hunt, when analysts saw a process named Updater.exe on a customer laptop trying to reach a domain nobody owned any more.

The binary belonged to Time4Popcorn, a closed-source fork of the long-dead Popcorn Time streaming client. Eye registered the lapsed domain and was hit by roughly 50 requests a second. Over six months it logged more than 3.8 million hardware identifiers, later revised to an estimate of 2.5 to 3 million Windows machines and 250,000 to 350,000 Macs. Most came from home broadband, but Eye also saw traffic from corporate, government and military networks.

The flaw became CVE-2026-30612 in June. With no vendor left to fix it, Eye went further. Between November 2025 and March 2026 it answered those update requests with a small payload that stopped and disabled the updater, after first taking legal advice. By December more than a million systems had received it; by 1 March update traffic had fallen by 98 per cent and over two million downloads had been served. Eye then transferred the 15 domains it controlled to the Shadowserver Foundation for sinkholing.

The technical picture

The updater is a textbook example of how not to ship software. It polled for new versions over plain HTTP, accepted whatever executable the server pointed it to, performed no signature check and ran the result with full privileges: SYSTEM on Windows, root on macOS. It started at boot, so exposure outlived any actual use of the app. Anyone who registered one of the abandoned domains, or who could tamper with a victim’s traffic on an open Wi-Fi network, had a remote code execution channel into every machine still running it.

Eye’s payload did the minimum. On Windows it stopped the “Update service” and set it to disabled; on macOS it unloaded the relevant launch daemon. The firm says it collected no telemetry and deleted nothing. Android installs were left alone, because updating there requires the user to approve the install and the updater cannot be separated from the app.

One detail deserves attention. After the payload was uploaded to VirusTotal, around a week later 11 security vendors were flagging it as malicious. Rather than chase every vendor with false positive reports, Eye modified its code to evade their signatures until only one product still detected it. The firm’s reasoning was that every blocked update left a vulnerable machine exposed.

Switching off the updater leaves the client itself dangerous: it runs a 2014 Chrome engine with the sandbox off and loads JavaScript over HTTP from abandoned domains. Eye’s advice is to uninstall it.

Timeline of Eye Security's Operation IXIM, from the initial threat hunt in 2025 to public disclosure at Hack.lu on 22 October 2026

Why it matters for UK organisations

The first issue is operational. An abandoned piracy client with a root-level updater was found on business laptops, calling home from corporate and government ranges. Unauthorised software is unmanaged attack surface that keeps running for years.

The second is legal, and it matters more to the UK research community. Eye acted on advice from its own legal team and drew a parallel with Operation Ladybird, the 2021 Dutch police operation that pushed an update to neutralise Emotet infections. The firm acknowledges the difference: Emotet victims never chose to be infected, whereas Popcorn Time users installed the client themselves, even if none of them agreed to a forgotten updater running in the background with full privileges.

In the UK, a private firm doing the same thing would be on uncomfortable ground. Section 1 of the Computer Misuse Act 1990 covers unauthorised access, and Section 3 covers unauthorised acts that impair a computer’s operation, with no good-faith exception in either. The argument that a machine “asked” for an update is novel and untested. The government’s latest position, given by a minister in the Lords in September, is a proposed Section 1 defence limited to “accredited cyber security researchers”, according to analysis by PK Sharma. No accreditation scheme has been published, and nothing on the public record suggests that defence would reach Section 3, which is where disabling a service on someone else’s machine would most naturally fall.

Expert view

I have a lot of sympathy for what Eye did. If you find millions of machines sitting behind an unauthenticated root shell and the vendor no longer exists, waiting for someone else to act is a choice with consequences. The payload was narrow, reversible, tested on a small set first and handed off to a trusted sinkhole operator afterwards.

But it sets a precedent the industry has to think through rather than simply applaud. When we test, everything rests on written authorisation and an agreed scope. Operation IXIM had neither from the owners of the affected machines; its justification was necessity and proportionality. Those are reasonable principles, but in the UK they are not currently a defence, and an accreditation-based model would not obviously cover a small firm acting on an urgent finding outside a formal engagement.

The AV evasion step also needs an honest discussion. Tuning code until endpoint products stop detecting it is exactly what attackers do, and defenders were right to flag an unknown binary disabling a service. Any framework for good-faith work must say where those lines sit.

The bigger lesson is about orphaned infrastructure. Lapsed domains baked into old software are a recurring problem, and the cheapest fix is for registries, sinkhole operators and national CERTs to have a recognised route for taking them over before criminals do.

What to do now

  1. Hunt for it. Search endpoint telemetry for Updater.exe paths linked to Popcorn Time on Windows and PT.updd on macOS, and for DNS lookups of the domains in Eye’s published indicators list.
  2. Remove, do not just disable. Uninstall Time4Popcorn wherever you find it. Disabling the updater leaves the vulnerable browser engine in place.
  3. Tighten software control. Enforce application allow-listing and remove local admin rights, in line with the Cyber Essentials secure configuration and user access control requirements.
  4. Treat end-of-life software as a vulnerability. Cyber Essentials already requires unsupported software to be removed; make abandoned consumer tools part of your asset inventory checks.
  5. Researchers: document everything. Until UK law changes, keep scope, authorisation and disclosure records, and take legal advice before touching systems you do not own.

Bottom line

Operation IXIM probably stopped a multi-million node botnet before anyone built it, and it was handled with more care than most. It also shows that useful, good-faith intervention has outrun the law in many countries, including the UK. If the government wants researchers to act when nobody else will, the promised Computer Misuse Act reform needs to cover more than access alone, and it needs an accreditation route that actually exists.

Sources

Related Posts