The Popcorn Time Botnet That Never Woke Up: How Researchers Hijacked Millions of Forgotten Installs
Millions of computers around the world were quietly waiting to become a hacker’s private army — and their owners had no idea. A long-abandoned streaming app was still phoning home from those machines through an updater so insecure that whoever claimed its expired web address could have seized full control of every one of them. But criminals never got the chance: security researchers got there first, hijacked the hijackers’ doorway and switched the whole thing off. This is the story of the Popcorn Time botnet that never happened — and why your old downloads folder may still deserve a second look.
The “Netflix of Piracy” That Refused to Die
Popcorn Time was once nicknamed the Netflix of piracy: a slick app with a Netflix-style interface that streamed films straight from BitTorrent. It became one of the most talked-about programs of the 2010s — and one of the most pursued, as film-industry lawyers chased its developers until the original project was abandoned.
But Popcorn Time never truly died. It splintered into unofficial forks kept alive by anonymous maintainers, and one closed-source fork called Time4Popcorn attracted millions of users of its own. The users eventually drifted away, but the software stayed behind. As Eye Security researchers would later discover, the Time4Popcorn updater kept running silently on millions of Windows, macOS and Android devices long after anyone stopped opening the app — “ghostware”: dead software with a live internet connection, and the raw material of a future Popcorn Time botnet.
A Flaw That Could Have Handed Attackers Every Computer
The trail began with a single odd sighting. Researcher Niels Teusink noticed an Updater.exe process on a customer’s laptop contacting a domain — popcorntimeupd.xyz — that nobody owned any more. That stray phone call unravelled into one of the largest abandoned-software scares ever documented, and the making of a potential Popcorn Time botnet.
The Time4Popcorn updater vulnerability was as basic as it was devastating: the updater checked for updates over plain, unencrypted HTTP and accepted whatever executable came back without verifying any digital signature. Anyone who registered the expired domain could therefore have pushed their own software to every connected machine and run it with the highest privileges available — SYSTEM on Windows, root on macOS. The flaw is now tracked as CVE-2026-30612, and CVE-2026-30612 may go down as one of the most consequential abandoned-app bugs ever found.
The scale was staggering. Researchers observed up to three million Windows clients and around 350,000 macOS clients still checking in — roughly 2.5 to 3 million Windows machines plus the Mac systems once the numbers were refined. The connections came from home internet providers, but also from corporate, government and even military networks, and almost none of the users seemed to be actively using the app. A ready-made Popcorn Time botnet, waiting for whoever claimed the domain first. The researchers warned that had it fallen into the wrong hands, the impact would have been severe: one takeover could have delivered ransomware to millions of systems at once.
Operation IXIM: The White-Hat Hijack
Faced with a loaded weapon lying in the street, Teusink and the Eye Security team made an extraordinary call. Between November 2025 and March 2026, in an effort they named Operation IXIM, they registered the abandoned update domain themselves — plus fourteen more tied to the updater — and used the same insecure channel to deliver their own payload. Operation IXIM was, in effect, a hijack of the potential Popcorn Time botnet before criminals could build it.
Their update did not install malware; it installed a kill switch. On Windows the payload simply stopped and disabled the updater service, deleting nothing. On macOS a shell script blocked the update process from ever starting. The researchers thus permanently closed the remote-code-execution hole on every machine they reached — by breaking the updater so thoroughly that no attacker could ever abuse it again. The disabling update reached more than two million unique systems, defusing the Popcorn Time botnet threat at its source.
The team was frank about the ethical tightrope: seizing someone else’s update channel, even to disarm it, is not a step researchers take lightly. Their answer was blunt — the alternative was to do nothing, and the updater “wasn’t doing anything functional anyway, it was only creating risk.” The payload avoided tripping antivirus software, collected no user data and damaged nothing. Eye Security notes its findings cover only the abandoned Time4Popcorn fork, not a newer legitimate project launched under the Popcorn Time name in early 2025.
What to Do If You Ever Installed Popcorn Time
One warning the researchers stress: Operation IXIM killed the updater, but it did not remove Time4Popcorn itself. The app still sits on those machines, and abandoned software can hide other unpatched flaws — the classic abandoned app security risk. If you ever installed Popcorn Time or its forks, go and check, and remove it properly.
That is trickier than it sounds, because piracy-era software often skips the usual installers. Time4Popcorn may live as a portable executable or inside a user folder rather than in Add/Remove Programs, so a thorough manual sweep — a full uninstallation, not just deleting a shortcut — is the only way to be certain the program and its background services are gone. Security experts say this Time4Popcorn updater vulnerability is a textbook abandoned app security risk: software nobody maintains, running with full system privileges, on machines whose owners forgot it exists.
The wider lesson is one Pakistan’s own watchdogs keep repeating: our National CERT recently warned organisations to refresh their trust stores before a compromised certificate authority is cut off — trusted components quietly go bad all the time. Old software you never open is not harmless just because you ignore it; it can keep a live, exploitable connection to the internet for years. And as millions more Pakistanis come online with faster connections, cleaning up forgotten apps is becoming basic digital hygiene. Millions of computers came within one domain registration of joining a criminal Popcorn Time botnet. This time, the good guys registered it first.
Sources: Eye Security research (Operation IXIM disclosure), BleepingComputer, CyberInsider, October 2026. Photo credits: featured image by Microbiz Mag (CC BY 2.0); researchers photo by Valerio Bozzolan (CC0); locked computer by Juan Pablo (CC BY 2.0, Flickr); server room by Indrajitdas (CC BY-SA 3.0); laptop cleaning by Shixart1985 (CC BY 2.0) — all via Wikimedia Commons, representational.
Related Posts
TechnologyRedmi K100 Launched in China: 10,000mAh Battery, Snapdragon 8 Elite and Prices From CNY 3,499
TechnologyPM Youth Chromebook Scheme 2026: 500,000 Chromebooks Launched — Who Can Apply and How to Apply Online
TechnologySUPARCO Opens UN Space Conference in Islamabad: Early Warning, Climate Action and Disaster Risk Assessment
TechnologyApple’s New M6 MacBook Pro and iMac Are Here: Specs, Prices and 6 November Release Date
TechnologyChrome’s emSign Root Removal Lands Today: What Pakistani Websites and Users Must Do
TechnologyApple’s New OLED iPad Mini Is Here: A20 Pro Power, 8.5-Inch Display and a $699 Price TagMost Popular
SportsBallon d’Or 2026: London Ceremony, Nominees and All-Time Records Ahead of 70th Anniversary289 views
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone289 views
TechnologyRedmi K100 Launching on 28 October: 10,000mAh Battery, 185Hz Display and Full Specs267 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule267 views
TechnologyAround 20 Pakistani Tech Companies Showcase Innovation at TechCrunch Disrupt 2026 in San Francisco262 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed257 views
One comment