Dutch Security Firm Pushed 2 Million Unauthorised Updates to Kill a Botnet-Ready Backdoor Nobody Knew Was Still Running
Between November 2025 and March 2026, Dutch security firm Eye Security quietly pushed over two million updates to computers it had no ownership of. The goal: kill a background process running on millions of machines worldwide before someone nastier found it first.
The process in question belonged to Time4Popcorn, a long-abandoned clone of the infamous Popcorn Time piracy app. Popcorn Time was enormously popular around a decade ago, streaming pirated films and TV over BitTorrent before the original shut down in 2014. Copies kept circulating under the same name for years. Time4Popcorn was one of them, and it apparently had a lot of loyal stragglers who never uninstalled it.
Eye's researchers stumbled onto this during a routine threat hunt on a client's network. A program called Updater.exe on a laptop was repeatedly hammering a web address that no longer belonged to anyone. Standard practice at that point: register the domain yourself and see what shows up.
What showed up was roughly 50 requests per second. Over six months, those requests came from more than 3.8 million distinct hardware IDs. Accounting for the fact that some Windows machines share IDs and some Macs rotate theirs, Eye revised that down to somewhere between 2.5 and 3 million Windows computers, plus another 250,000 to 350,000 Macs. Not a small number.
The updater had been sitting in the background on all of these machines since boot, silently checking for new software over an unencrypted connection and installing whatever it received. On Windows it ran as SYSTEM. On Mac it ran as root. It performed zero verification of who was actually sending the update. Because the domains it phoned home to had been left to expire, anyone willing to spend a few dollars on a domain registration could have started serving their own code to millions of machines at the highest possible privilege level.
Ransomware, credential theft, botnet recruitment. All viable. Eye mapped a sample of the connecting IP addresses and found not just home users but machines sitting on government, military, and corporate networks. They were careful to note that drawing firm conclusions from IP geolocation is a mug's game, but the spread was broad enough to be concerning.
The vulnerability is now tracked as CVE-2026-30612. CISA rates it 9.8 out of 10. It affects Windows versions up to and including 6.2.1.18, Mac versions up to 6.2.1.17, and Android versions up to 3.5.0.173.
The problem with a 9.8-rated flaw in abandoned software is that there is no company left to issue a patch. Eye decided to use the updater's own mechanism against it. After taking legal advice, they crafted an update that does exactly one thing: stops and disables the updater. No files deleted, nothing collected from the machine.
The closest precedent Eye could find was Operation Ladybird in 2021, when Dutch police pushed an update through Emotet's own infrastructure to kill the malware on infected systems. Eye acknowledged the ethical difference: Emotet victims were unwilling. Popcorn Time users installed the app themselves. That said, nobody who installed a piracy app in 2016 made a conscious choice to have a root-level update daemon phoning home in perpetuity.
Almost immediately after the updates started rolling out, someone uploaded Eye's update package to VirusTotal. Antivirus engines started flagging it as malware, which is technically fair since it does disable a Windows service. The catch: every AV product that blocked Eye's update left the vulnerable updater happily running. Eye reworked the package until only one scanner continued to flag it.
By December 2025, more than a million systems had received the update and traffic to Eye's domains had dropped by around 90 percent. By March 1, it was down to roughly 5,000 updates per day, a 98 percent reduction from peak. At that point Eye decided the remaining population was small enough to be unattractive to any serious threat actor and stopped sending updates.
In late March, Eye handed the 15 domains it had registered to the Shadowserver Foundation, the non-profit that specialises in taking abandoned and malicious domains out of circulation. Public WHOIS records for popcorntimeupd[.]xyz show the transfer dated March 20, 2026. The remaining domains the updater calls, those Eye never controlled, are still out there. Machines still reaching those are still exposed.
For what it's worth, Eye found no evidence anyone else had been serving code through the abandoned addresses before they got there. The pre-registered domains were parked or listed for sale, not actively exploited. That might have changed.
Disabling the updater does not make Popcorn Time safe to use. The app runs on a browser engine from 2014, with its security sandbox disabled, loading content over unencrypted connections and pulling code from other abandoned domains. Eye registered some of those too, and confirmed they could have run arbitrary code on any machine that opened the app. They built a working proof of concept to demonstrate it. They did not use it, but the capability was real.
The only sensible advice here is to uninstall Popcorn Time entirely. If for some reason that is not immediately possible, the updater can be manually disabled. On Windows, two commands will do it:
sc.exe stop "Update service"
sc.exe config "Update service" start= disabled
On Mac:
launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
On Android, the updater is baked into the app itself and cannot be isolated, though it does require the user to tap to accept before installing anything. Eye did not push updates to Android devices for that reason. Removing the app is the only fix there.
Network defenders can hunt for Updater.exe on Windows or PT.updd on Mac, and monitor for traffic to the domains listed in Eye's full write-up, which also includes file hashes. The vulnerability has not, as of late October 2026, appeared in CISA's known exploited vulnerabilities catalogue.