Once registered they began receiving around 50 requests per second. Their investigation into the issue, called Operation IXIM, was presented at the Hack.lu conference on October 22.
Eye were able to collect over 3.8 million unique device IDs. These were not a reliable way to determine how many devices were affected so they have estimated 2.5 – 3 million Windows machines and 250,000 – 350,000 Macs were impacted.
The background updater would automatically start when the computer booted up. It would check for updates over an unencrypted connection and install any software it received without checking where it came from. It also ran with full permissions on the device (SYSTEM on Windows and root on macOS). Anyone who registered a domain that the updater was still connecting to could potentially deliver malicious code.
The vulnerability, tracked as CVE-2026-30612, has been given a severity score of 9.8/10 by the U.S.
Cybersecurity and Infrastructure Security Agency. It affects Windows versions up to 6.2.1.18, macOS versions up to 6.2.1.17 and Android versions up to 3.5.0.173.
As there was no company to provide a patch, Eye sought legal advice. They delivered an update using the background updater to stop and disable the service. No files were deleted or data collected. Some antivirus products flagged the update so it was adjusted to improve delivery.
Over one million systems were updated by December 2025. Traffic to the controlled domains dropped by around 90%.
By March 1st the number of deliveries per day had dropped to around 5,000 meaning a 98% reduction. Eventually Eye stopped distributing updates as they had over two million downloads.
In late March 15 domains were handed over to the non-profit group Shadowserver Foundation. 17 of the 20 domains listed in the report were pointing to Shadowserver. 3 were not under their control. Some of the services could not resolve 14 of the sinkholed domains correctly due to issues with DNSSEC validation.
There was no evidence to suggest any third parties had delivered code via the domains. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities Catalogue as of October 23.
Eye have warned that even with the background updater disabled Popcorn Time is not secure. As it uses an old browser engine with the sandbox disabled, unencrypted connections and code from other abandoned domains we recommend uninstalling it.
Users on Windows and Mac can disable the background updater manually, however on Android it will need to be uninstalled as the background updater cannot be disabled. Network defenders can look for Updater.exe on Windows, PT.updd on Mac and traffic to the domains listed in the report.
