A major security risk affecting millions of legacy installations of the Popcorn Time piracy app has been neutralized following a high-stakes domain takeover by cybersecurity researchers. The vulnerability, tracked as CVE-2026-30612, resided in a background updater within the “Time4Popcorn” fork of the application—an app that has been largely abandoned by its developers but remains installed on millions of systems worldwide.
The flaw allowed for high-privilege Remote Code Execution (RCE), meaning an attacker could take full control of a victim’s computer. Because the background updater was designed to run with elevated permissions—NT AUTHORITY\SYSTEM on Windows and root on macOS—any malicious code delivered through this channel would have total authority over the host operating system.
The Vulnerability: CVE-2026-30612
The technical failure in the Time4Popcorn updater was twofold. First, the application communicated with its update server over unencrypted HTTP, making it trivial for an attacker to intercept or spoof traffic. Second, the updater failed to perform any digital signature verification on the executables it downloaded. This combination meant that if an attacker could control the update domain, they could force millions of devices to download and run malware silently in the background.
Security experts at Eye Research identified that the domain used for these updates, popcorntimeupd.xyz, had lapsed. This created a “ghostware” scenario where millions of devices were still actively pinging a dead domain, waiting for instructions that anyone could now provide by simply registering the address.
Operation IXIM: The White-Hat Hijack
Recognizing the potential for a global botnet or mass ransomware event, researcher Niels Teusink and the team at Eye Research launched “Operation IXIM” between November 2025 and March 2026. After registering the abandoned domain themselves, the researchers were able to intercept the traffic from millions of active installations.
Rather than delivering malware, the researchers pushed a “fix” designed to break the updater’s functionality. By delivering an update that essentially disabled the background service, the researchers permanently closed the Remote Code Execution (RCE) vector for those devices, preventing future malicious actors from exploiting the same path. According to research data, the operation successfully delivered these disabling updates to over two million unique systems.
The scale of the “ghostware” problem was significant. Initial estimates suggested nearly 4 million devices were affected, though Eye Research later clarified that due to hardware identifier collisions, the more accurate count was approximately 2.5 to 3 million Windows computers and roughly 350,000 macOS systems.
Identifying and Removing the Software
While Operation IXIM neutralized the immediate threat of a remote hijack, it did not remove the Popcorn Time software itself. The researchers’ intervention only disabled the vulnerable updater; the abandoned piracy app remains on the system and may contain other unpatched vulnerabilities. This specific risk applies to the “Time4Popcorn” fork.
Users are encouraged to check their systems for any legacy versions of the app. Because the software was often used for piracy, it may not appear in standard “Add/Remove Programs” lists if it was installed as a portable executable or hidden within user directories. A thorough manual uninstallation is the only way to ensure the software and its associated background services are completely removed from a device.
