Dutch Firm Eye Security Pushed 2 Million Updates to Strangers' PCs to Disable Abandoned Popcorn Time Updater

Between November 2025 and March 2026, the Dutch security firm Eye Security sent more than 2 million updates to computers it did not own. The goal was to switch off a background updater that, the firm says, would have let anyone who controlled the right web address take over those machines.

The firm named the effort Operation IXIM. It published the details and presented them at Hack.lu on October 22.

How a pirate app became a security hole

The software is Time4Popcorn, a closed-source fork of Popcorn Time. Popcorn Time was the "Netflix for piracy" app that streamed films and TV over BitTorrent. The original shut down in 2014, and several copies kept running under the name. A separate, legal project that took the Popcorn Time name in early 2025 is unrelated.

Eye found the problem during a routine threat hunt. A program called Updater.exe on a client's laptop kept trying to reach popcorntimeupd.xyz, a domain nobody had registered anymore.

Eye registered it to see what would happen. About 50 requests per second poured in.

Over six months those requests carried more than 3.8 million different hardware IDs. Eye says the IDs are an unreliable head count, since some Windows PCs shared one and some Macs changed theirs. Its revised estimate is 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs.

What the updater did

The design was reckless. According to Eye's technical write-up by researcher Niels Teusink, the Windows updater asked its domains for a JSON file over plain, unencrypted HTTP. It downloaded whatever executable that file pointed to and ran it as SYSTEM. Nothing checked a code signature. The Mac version did the same job as root.

The flaw is tracked as CVE-2026-30612. The U.S. Cybersecurity and Infrastructure Security Agency rates it 9.8 out of 10. Eye disclosed it in June. There is no patch, because there is no company left to write one.

An attacker with a machine at that level of access could install ransomware, steal saved passwords or pull the computer into a botnet, Eye said. Teusink said the mechanism could also be used for surveillance or to target specific devices through a man-in-the-middle attack.

Eye said the connecting addresses included home users worldwide, as well as machines on government, military and corporate networks. The firm added that it is "hard to draw conclusions" from that. None of the connecting users appeared to be actively using the app. It looked installed and forgotten.

The fix: use the hole against itself

Eye registered 14 more lapsed domains on top of the first, 15 in all. It weighed buying every abandoned domain, which would be expensive and incomplete because third parties already held some. It weighed doing nothing. It chose to send an update.

The update does one thing. On Windows it stops and disables the updater service through the Service Control Manager. On macOS a shell script blocks the update process from starting. Eye says it deleted no files and collected no host data or telemetry. The firm says it took legal advice first.

The operation did not go cleanly at first. Antivirus programs flagged the payload as malware for disabling a service, so Eye reworked it. Eye says requests to its update domain had dropped 98% by March 1. It then stopped sending the update and handed the domains to the Shadowserver Foundation, a security non-profit.

The ethics problem

This is the uncomfortable part. Eye changed software on millions of machines that belong to other people, without asking them.

Eye acknowledges the ethical questions itself. It compares the step to Operation Ladybird in 2021, when Dutch police pushed an update to disable the Emotet botnet. It also concedes a difference: Emotet victims never chose to be infected, while Popcorn Time users installed the app themselves.

Eye's answer is that the alternative was inaction. "The update process wasn't doing anything functional anyway, it was only creating risk for users," the firm said.

That is Eye's own account of its own conduct. The firm has not said who, if anyone, authorized the push beyond its lawyers.

What is still exposed

The job is not finished. Android users remain at risk. On that platform the app checks for updates only when opened and asks the user before installing an APK, so Eye could not disable it remotely.

The app also ships an engine based on a 2014 version of Chrome with no sandbox protections, which could be exploited separately.

Eye's advice, and that of security writers following the disclosure, is to remove Time4Popcorn entirely. The Windows updater runs from the moment the PC starts, so anyone who installed a Popcorn Time clone years ago and forgot about it should check. The vulnerable code stays on disk with its updater switched off, and the software stays unpatched.