Millions of Windows and Mac computers had a background updater that could have allowed attackers to take control of them if it remained running, according to Eye Security’s estimates. The firm put the vulnerable software on 2.5–3 million Windows computers and around 250,000–350,000 Macs.
The risk persisted because Time4Popcorn was eventually abandoned while its update infrastructure was left behind, Eye Security said. The updater used unencrypted HTTP connections and accepted executable files without checking digital signatures to establish that they were genuine.
The investigation began when Eye Security researchers found a process called Updater.exe on a client laptop trying to contact an abandoned update domain.
Time4Popcorn was a version of the once-popular streaming app Popcorn Time, whose original project was abandoned shortly after launching in 2014.
The software’s associated domains had become available for others to register. The flaw was logged as CVE-2026-30612 and could have allowed an attacker to run malicious software on an affected device.
Eye Security registered an abandoned update domain in November 2025. It then saw approximately 50 requests per second from millions of devices around the world.
Those connections came from residential internet service providers, government and military networks, and corporate devices. Over six months, the company logged more than 3.8 million unique hardware IDs seeking updates.
Eye Security concluded that the updater was present on an estimated 2.5–3 million Windows computers, 250,000–350,000 Macs and fewer than 200,000 Android devices.
The desktop application also contained an obsolete Chrome engine dating from 2014 and had sandbox protections disabled.
The researchers reverse-engineered the update process, then used the same mechanism to send code that disabled the updater on Windows and macOS systems. On Windows, the fix stopped and disabled the service. On macOS, it stopped the update process from launching.
By December 2025, more than 1 million systems had received the fix. By March 2026, more than 2 million systems had downloaded it, and requests to Eye Security’s domains had fallen by 98%.
Eye Security said the work from November 2025 to March 2026 had pushed the update to almost all affected computers. It said the remaining 2% of update requests appeared to come from Android devices, which apparently continued to face the risk.
In March 2026, Eye Security transferred the 15 domains it controlled to the nonprofit Shadowserver Foundation, which continued to sinkhole the connections.
Supply-chain weaknesses can leave subtle traces before their wider consequences are clear. A Microsoft engineer noticed SSH logins running 500ms more slowly because of the xz-utils backdoor.
Comments (0)