Threat reportVulnerabilityTL-2026-4311
Abandoned Time4Popcorn (Popcorn Time) insecure updater enables SYSTEM/root RCE via domain takeover (CVE-2026-30612)
Abandoned Time4Popcorn (Popcorn Time) insecure updater (TL-2026-4311), also tracked as Operation IXIM, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-23 and last reviewed 2026-10-24. It has no confirmed attribution, affects Time4Popcorn Time4Popcorn for Windows, references 1 CVE (CVE-2026-30612), maps to 9 MITRE ATT&CK techniques (T1071.001, T1105, T1195.002), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4311
- Threat ID
- TL-2026-4311
- Also known as
- Operation IXIM
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, military, corporate, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
- Updates
- 2026-10-24 · revalidated 1× · latest source
Malware and tooling in Abandoned Time4Popcorn (Popcorn Time) insecure updater
Malware and tooling: Popcorn Time, Time4Popcorn
How Abandoned Time4Popcorn (Popcorn Time) insecure updater works
The Time4Popcorn updater polled abandoned, unregistered domains (e.g. popcorntimeupd.xyz) over an insecure channel and did not verify signatures on downloaded executables, so whoever registered the domain could push code that ran as SYSTEM (Windows) or root (macOS). Eye Security researchers registered the domains, found millions of live clients, and pushed a benevolent update that disables the updater; Android users remain exposed.
Time4Popcorn is a fork of the abandoned Popcorn Time BitTorrent streaming application. Its update mechanism never stopped running, and millions of installations kept polling update domains that were no longer registered. During routine threat hunting, Eye Security (researcher Niels Teusink) registered one of these domains and saw requests arriving every second, with millions of unique hardware IDs observed over several months from residential ISPs and from corporate, government and military networks. BleepingComputer reports up to 3 million Windows client connections and 350,000 macOS client connections.
Reverse engineering of the closed-source Windows and macOS updater binaries showed that the updater connects to its update servers over an insecure channel (plain HTTP) and does not verify digital signatures on the executables it downloads. An attacker controlling the update domain, or able to manipulate the traffic, could deliver an arbitrary executable. On Windows the updater runs as the auto-starting 'Update Service' (Updater.exe) as NT AUTHORITY\SYSTEM; on macOS it is the privileged helper PT.updd, registered via a LaunchDaemon, running as root. Execution needs no user interaction. On Android the updater is embedded in the app and prompts for APK installation only when the app is opened, so user approval is required and it cannot be remediated remotely. NVD classifies the flaw as CWE-494 (Download of Code Without Integrity Check) with CVSS 3.1 base score 9.8.
Affected versions are Time4Popcorn for Windows 6.2.1.18 and earlier, macOS 6.2.1.17 and earlier, and Android 3.5.0.173 and earlier. Fixed builds that remove the vulnerable updater are Windows 6.2.1.19, macOS 6.2.1.18 and Android 3.5.0.174 per the CVE record aggregators, although the Eye Security write-up states that no vendor update is available because the software is abandoned. The application also embeds a roughly 2014-era Chrome engine with no sandbox, so the product stays unsafe even with the updater disabled.
Between November 2025 and March 2026 Eye Security deployed a 'benevolent update' payload to disable the updater remotely (no telemetry collection or file deletion), reporting about 2 million update downloads and a 98% drop in update-domain requests by 1 March 2026. The researchers registered 15 update-related domains in total, and the infrastructure is now sinkholed by The Shadowserver Foundation. Eye Security presented the work ('Operation IXIM') at Hack.lu on 22 October 2026. No malicious in-the-wild exploitation by threat actors is stated in the sources; the risk is that any party acquiring the abandoned domains could have built a botnet.
MITRE ATT&CK techniques used in TL-2026-4311
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Initial Access
T1195.002 Compromise Software Supply Chain
Execution
Persistence
T1543.003 Windows Service; T1543.004 Launch Daemon
Credential Access
Impact
T1565.002 Transmitted Data Manipulation
Resource Development
Affected products and versions in Abandoned Time4Popcorn (Popcorn Time) insecure updater
- Time4Popcorn — Time4Popcorn for Windows
Vulnerable versions: <= 6.2.1.18
Fixed in: 6.2.1.19 - Time4Popcorn — Time4Popcorn for macOS
Vulnerable versions: <= 6.2.1.17
Fixed in: 6.2.1.18 - Time4Popcorn — Time4Popcorn for Android
Vulnerable versions: <= 3.5.0.173
Fixed in: 3.5.0.174
Remediation for Abandoned Time4Popcorn (Popcorn Time) insecure updater
Patches
- CVE records list builds that remove the updater: Windows 6.2.1.19+, macOS 6.2.1.18+, Android 3.5.0.174+; Eye Security states no vendor update exists because the project is abandoned
Immediate actions
- Windows: sc.exe stop "Update service" and sc.exe config "Update service" start= disabled
- macOS: launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
- Inventory endpoints for Popcorn Time / Time4Popcorn installs (Updater.exe, PT.updd) and block or alert on DNS/HTTP requests to popcorntimeupd.xyz
Workarounds
- Remove the Update Service (Windows) or PT.updd LaunchDaemon (macOS)
- Do not approve APK installation prompts from the Android app
Longer-term hardening
- Uninstall Time4Popcorn/Popcorn Time from all platforms, including Android; the embedded 2014-era Chrome engine is unsandboxed and unsafe
- Use application allow-listing and block unsanctioned P2P streaming software on managed endpoints
- Require signed, TLS-protected updates for software you ship or deploy
CVEs associated with Abandoned Time4Popcorn (Popcorn Time) insecure updater
Weaknesses (CWE) in Abandoned Time4Popcorn (Popcorn Time) insecure updater
Timeline of Abandoned Time4Popcorn (Popcorn Time) insecure updater
- Eye Security begins the remediation phase (Nov 2025 to Mar 2026) after registering abandoned Time4Popcorn update domains and observing millions of unique hardware IDs polling them
- Over 1 million systems updated with the disabling update by December 2025, with about 90% reduction in updater traffic (month only; exact day not stated).
- Requests to the update domain fall by about 98% after the benevolent update disabling the updater is delivered to roughly 2 million systems
- Abandoned update domains transferred to The Shadowserver Foundation, which sinkholes most of the update infrastructure (per The Hacker News coverage).
- Remediation phase ends (March 2026); update domain ownership transferred to The Shadowserver Foundation, which sinkholes the infrastructure
- Eye Security Labs publishes the CVE-2026-30612 analysis by Niels Teusink describing the insecure Time4Popcorn updater
- CVE-2026-30612 published in NVD (CVSS 3.1 9.8, CWE-494); last modified 2026-09-01
- Niels Teusink presents 'Operation IXIM: Preventing a botnet of millions of PopCorn Time users' at Hack.lu 2026
- BleepingComputer reports up to 3 million Windows and 350,000 macOS client connections, with Android users still exposed
- The Hacker News reports researchers pushed over 2 million updates to disable the Popcorn Time updater; estimates 2.5-3 million Windows and 250,000-350,000 macOS devices still run the updater.
Update history for TL-2026-4311
- 2026-10-24 — Abandoned Time4Popcorn Updater RCE (CVE-2026-30612) Could Fuel Botnet; Eye Security Pushed 2M+ Disabling Updates: What changed Severity HIGH - CRITICAL to align with the CVSS 3.1 9.8 base score (impact already CRITICAL) that both reports cite. Exploitability stays THEORETICAL: neither report documents malicious in-the-wild use. Status unchanged (MONITO
Sources cited for Abandoned Time4Popcorn (Popcorn Time) insecure updater
- Abandoned Popcorn Time app exposed millions of device to RCE attacks
- CVE-2026-30612: A vulnerability in Time4Popcorn / PopcornTime (Eye Security Labs)
- NVD - CVE-2026-30612
- Hack.lu 2026: Operation IXIM: Preventing a botnet of millions of PopCorn Time users
- OpenCVE - CVE-2026-30612
- SOCRadar IOC Radar - CVE-2026-30612
- Time4Popcorn (vendor site referenced by NVD)
Detection coverage for TL-2026-4311
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4311 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.