Abandoned Popcorn Time App Could Infect Millions via Auto-Update

How an expired domain opened millions of machines

A piece of forgotten streaming software nearly turned into a distributed disaster. Time4Popcorn, an abandoned open-source fork of the notorious piracy program Popcorn Time, continued running an automated background updater on millions of systems long after the developers walked away.

The problem was built directly into its network logic. The desktop client regularly phoned home to a hardcoded domain, popcorntimeupd.xyz, over unencrypted HTTP. Worse, whenever that address returned an executable, the application executed it without validating any cryptographic signatures.

When the original project collapsed, the developers allowed the registration on that update domain to expire. That left a trivial route to absolute device takeover: anyone willing to buy an inexpensive web address could serve arbitrary binaries straight into system memory.

CVE-2026-30612: vulnerability profile

A silent vaccine deployed to corporate and military nets

Tracked as CVE-2026-30612 with a near-maximum severity score of 9.8 out of 10, the exploit was discovered by researchers at Eye Security before threat actors realized it existed. The firm registered the abandoned domain to evaluate the attack surface and watched incoming traffic spike immediately.

Pings poured in from 3 million Windows machines and roughly 350,000 macOS installations. The connections came from ordinary home ISPs, but also from enterprise workstations and restricted government and military networks where someone had installed the app years ago and forgotten about it.

Instead of harvesting telemetry or dropping exploits, Eye Security crafted a benign patch. From November 2025 through March 2026, the researchers fed connecting machines a tiny routine that permanently disabled the updater routine. Incoming requests dropped by 98 percent over the intervention window, after which researchers handed the domain infrastructure to The Shadowserver Foundation for long-term defensive sinkholing.

The persistent shadow of abandoned software

Defensive software takeovers like this are legally delicate and extraordinarily rare, yet they highlight how persistent 'zombie software' remains in corporate IT inventories. While traditional network perimeters catch suspicious out-of-band traffic, internal updaters running inside trusted processes routinely bypass enterprise filters.

This dynamic mirrors the risks seen when rogue files exploit automated desktop agents without user consent. When a desktop program runs an unauthenticated HTTP poll in the background, system trust dissolves entirely.

Even with the domain neutralized, roughly 2 percent of outbound requests remain active, mostly stemming from legacy Android builds that ignored the desktop fix.

What it means for your devices

If you installed Popcorn Time or any of its derivatives on a home or office laptop years ago, do not rely solely on the automated fix. Search your applications folder or Windows installed programs list, locate any variation of Time4Popcorn, and uninstall it entirely.

System administrators across the US, UK, and Europe should also audit software inventories for lingering binaries. While the primary domain is safely held by Shadowserver, abandoned peer-to-peer applications retain inherent attack vectors that enterprise firewalls should not permit.