Eye Security Says It Used Popcorn Time’s Abandoned Updater to Disable It on Over a Million Systems, and Three of the 20 Domains It Lists Are Still Outside the Sinkhole

Eye Security, a managed security services provider, says that between November 2025 and March 2026 it used the update mechanism of Time4Popcorn, an abandoned fork of the Popcorn Time streaming client, to run code on machines that still had the app installed. According to Eye the code did one thing, which was to stop and disable the updater, and it could be delivered only because Eye had registered domain names the updater was still polling. The company says it sent out “over 2 million update downloads” before it stopped and moved 15 domains to The Shadowserver Foundation. Eye published the full account on October 22, the day of its hack.lu talk, and The Verge and BleepingComputer covered it on October 23.

The updater ran as SYSTEM on Windows and as root on macOS, took a link to an executable from a JSON reply over plain HTTP and, in Eye’s reverse engineering, checked no signature, so whoever controlled one of its domains could run code on every machine that polled it. We checked the public record this morning, October 24, between 10:13 and 10:20 UTC. Of the 20 domains Eye lists, 17 are delegated to Shadowserver’s sinkhole name servers, but 14 of those 17 return SERVFAIL on Cloudflare’s and Google’s public resolvers because the .info registry publishes a DS record for a zone that has no DNSKEY. The other three domains are not on the sinkhole, and two of them were registered anew on October 19. The CVE record for the flaw never mentions Eye and cites an unrelated router write-up.

What Eye Security says it did

Eye found the updater in routine threat hunting. A process called Updater.exe on a client’s laptop was trying to reach popcorntimeupd[.]xyz, which, in the post’s words, “wasn’t registered anymore.” Eye registered the name and watched about 50 requests a second arrive, each carrying an app ID, a hardware ID (the post calls it “hid”), a version and an operating system code. Over the next six months it logged “over 3.8 million” distinct hardware IDs: about half from Windows, about 45 percent from macOS and fewer than 5 percent from Android. Most clients connected from end-user ISPs, but Eye also saw connections from “various government and military networks” and “a lot of clients” on corporate networks, and says it is “hard to draw conclusions from this.” Eye adds that a separate project that has used the Popcorn Time name since early 2025 to build a legal alternative is not affected.

Reverse engineering showed what the updater did with a reply. On Windows it downloaded the executable named in a JSON response and ran it as NT AUTHORITY\SYSTEM; on macOS the equivalent ran as root. Eye writes: “There was no code signing and this process was all happening over HTTP.” The Windows updater is C++ built with Boost 1.55, which Boost’s release history dates to November 11, 2013. On Android the app checks for updates only when a user opens it and then asks the user to install an APK, so Eye did not touch Android.

A normal disclosure was not possible. Eye calls the vendor “a bunch of pirates,” says they appeared to have lost control of the domains, and notes that the site that distributed the software has been inactive for years. Buying every domain was weighed and set aside: some were parked or offered for thousands of dollars, one hosted a personal blog, a single miss would leave a gap, and updates over unencrypted HTTP would still be open to anyone able to tamper with a victim’s traffic.

The update itself was small. On Windows it stops the service and sets it to disabled through the Service Control Manager; on macOS it runs launchctl unload -w /Library/LaunchDaemons/PT.updd.plist. Eye says it collected no telemetry and deleted no files. For the first weeks it offered the update only to hardware IDs it had already seen, once each, and redirected clients to HTTPS where possible, then dropped those limits to reach more systems. Someone uploaded the update to VirusTotal, and a week later 11 vendors flagged it as malicious, so Eye reworked it until, in its words, it was “only detected by a single vendor.”

A timeline from the post, the registry and the CVE record

Dates after the first row come from Eye’s post, the registry (RDAP) records, the CVE.org record or the outlets named in the last column.

What the post’s numbers count

Eye revises its own counts in the post, and the figures are easy to misread. The table sets each one beside what it counts.

The post also explains why the counts moved. The Windows hardware ID is an MD5 hash of the C drive’s volume serial number, its volume GUID and the MachineGuid from the registry. In Eye’s disassembly the error check after RegCloseKey is inverted, so a successful call skips the step that adds the MachineGuid and only disk metadata goes into the hash. Microsoft documents both RegQueryValueExA and RegCloseKey as returning ERROR_SUCCESS on success, and its error-code list gives ERROR_SUCCESS the value 0, which fits Eye’s description. Cloned disk images then share one ID: Eye found a single volume GUID on hundreds of HP EliteBook and ProBook G9 laptops across many customers. On macOS the ID is built from network hardware addresses, the hostname and the CPU type, so a hostname change or address randomization makes one Mac look like several.

What the public record shows on October 24

Times are UTC. We used registry (RDAP) records and the public DNS-over-HTTPS interfaces of Cloudflare and Google, and sent no request to any of the 20 domains. RDAP does not show who registered a domain, so what follows is about records, not owners. Names are written with [.] so they do not become links. In the table, “Sinkhole” means the Shadowserver name servers described below, and the last column shows what Cloudflare’s and Google’s validating resolvers return for an A lookup.

Seventeen of the 20 domains use the five name servers sinkhole-00 to sinkhole-04.shadowserver.org and sit at a registrar named Stichting Registrar of Last Resort Foundation, with client delete and transfer locks. Fifteen show a registry transfer event on March 20, 2026, which matches Eye’s “late March” transfer of 15 domains; two more show one on May 13. The Global Cyber Alliance’s wiki says Shadowserver operates a Registrar of Last Resort, though we found nothing that ties the foundation named in RDAP to Shadowserver or states its renewal policy.

The 14 sinkholed .info names are the odd ones. The .info registry publishes a DS record for each (key tags such as 36672 for pctupd[.]info), but a DNSKEY lookup returns no record for any of them. A validating resolver cannot build a chain of trust from that. Cloudflare’s resolver answers SERVFAIL with extended error 9, which RFC 8914 defines as “A DS record existed at a parent, but no supported matching DNSKEY record could be found for the child,” and Google’s answers SERVFAIL with a DNSSEC validation failure. With checking disabled the resolvers return ten sinkhole addresses in Leaseweb and Hurricane Electric ranges (we tested all 14 names on Cloudflare and one on Google). The three sinkholed .xyz names have no DS record and resolve normally. We looked at which resolvers validate in our post on the root key rollover.

What that means depends on resolvers we cannot see. A Time4Popcorn machine behind a validating resolver gets an error for those 14 names, so while the records stay as they are it can neither reach the sinkhole nor be served an update through those names; a machine behind a resolver that does not validate reaches the sinkhole. A sinkhole can only count clients that reach it. We cannot tell from outside whether the DS records are deliberate, and we found no statement from Eye or Shadowserver about them. A DS record left behind after a change of DNS host is one possible cause, but that is our guess.

The other three names are not on the sinkhole. updpopcorntime[.]xyz was created on March 12, 2026 and uses ns.parktons.com and ns2.parktons.com, and the nine addresses it returns are in the network of its registrar, Gransy. popcorntime-upd[.]xyz and time4popcorn[.]info were both created on October 19, three days before the talk, with TransIP name servers and no address records. Eye’s post says “some domains are still owned by third parties,” and the registry does not show whether Eye, a third party or someone else holds these three. The post does not say which platform uses which domain, but any client that still polls one of them takes its instructions from whoever controls it. Control of a name doubling as authority is also the lever behind the .gh, .sl and .as hijacks we covered on October 8, where control of country-code DNS was used to get HTTPS certificates issued for Google’s names.

A sinkhole lasts only as long as its registrations. The registry shows nine of the 17 sinkholed domains expiring in February 2027, the first on February 12, five on October 30, 2027, and the three .xyz names in January and February 2028.

What the CVE record and NVD say

CVE-2026-30612 is public but thin. The CVE.org record, published by MITRE on August 27, says an issue in “Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173” lets a remote attacker run arbitrary code through updater.exe on Windows and PT.updd on macOS. The vendor, product and version fields say n/a, the record names no credit, and Eye’s advisory is not among its references. Those are time4popcorn[.]com and a GitHub write-up about command injection in an LB-LINK AC1900_AZ2 router, which describes a different CVE, CVE-2026-35867. NVD lists the record as Deferred. CISA’s ADP entry adds CVSS 3.1 9.8, the weakness CWE-494 (Download of Code Without Integrity Check) and SSVC values of Exploitation: poc, Automatable: yes and Technical Impact: total. CISA’s Known Exploited Vulnerabilities feed (version 2026.10.23, 1,756 entries) did not list it at 10:17 UTC.

The legal question the post leaves open

Eye asks the question itself: “But is this ethical? Could we get into legal trouble?” It says its legal team “was able to provide some advice,” and the post does not say what that advice was, which country’s law it covered, or whether any user complained. The hack.lu abstract lists the “ethical and legal considerations” around a “benevolent update” among the talk’s topics. BleepingComputer goes further. It writes that the payload collected no host data and deleted no files, “keeping their actions within a fully legal context.” That is the outlet’s own gloss, and we found no such conclusion in Eye’s post or the talk abstract.

The precedent Eye cites is Operation Ladybird, the 2021 Emotet takedown. In the January 2021 report from The Hacker News that Eye links, the Dutch police “seized two central servers” and “deployed a software update to neutralize the threat.” Eye names the difference itself: Emotet’s victims “never intentionally became part of a botnet, while these users presumably voluntarily installed the software.” That is a police operation on seized servers set beside a private company that registered lapsed domains.

What is still exposed

Eye’s update only disabled the updater. Android was not touched, because installing an update there needs a user’s tap and the updater is part of the main app. The app itself, Eye says, “is built on a Chrome engine from 2014, with the sandbox disabled,” loads content over unencrypted HTTP and pulls JavaScript from abandoned domains that Eye registered. Eye says it could have run its own JavaScript in the app on every system where it was opened and “didn’t,” and it describes a proof of concept that starts calc.exe through JavaScript. Its advice is “simple: uninstall it.”

What to check

Eye’s indicators are the 20 domains and two file names. Updater.exe usually sits under C:\Program Files\Popcorn Time\Updater.exe (the advisory also gives the Program Files (x86) path), and PT.updd under /Library/PrivilegedHelperTools/. The VirusTotal links in the post point to SHA-256 6f895e70e5e560b4b8189a8f7eddf59ea1d237c3d69af7c9e55cfbd76f334827 for Updater.exe and 4e4ad25e652768157b460a62f87f3d41586a40da4b3b8e40ee35a28d3f5cca03 for PT.updd; the post does not say how many versions exist. A DNS or proxy log search for the 20 names finds machines that still run the app or its updater. Eye asks endpoint vendors to treat both files as potentially unwanted programs.

If removal has to wait, Eye’s advisory gives these commands to disable the updater, the first two for Windows and the third for macOS. We have not run them.

sc.exe stop "Update service"
sc.exe config "Update service" start= disabled
launchctl unload -w /Library/LaunchDaemons/PT.updd.plist

Open questions

• Who holds popcorntime-upd[.]xyz, time4popcorn[.]info and updpopcorntime[.]xyz, and what they serve. We sent no request to them.
• Whether the DS records on the 14 sinkholed .info names are deliberate, and whether Shadowserver’s sinkhole data covers clients behind validating resolvers.
• How many machines the update actually disabled. The post gives downloads, not devices.
• What the legal advice was and which jurisdiction it covered.
• Whether anyone served a malicious update from these names before Eye registered them. We found no report of one, and the post does not address it.

Sources and method

Eye’s October 22 post, its June 11 advisory and the hack.lu talk page are the primary text. The Verge and BleepingComputer supplied the outlet framing quoted above. The CVE.org record, NVD record and CISA’s KEV feed were read through their public APIs on October 24. The Boost release history, three Microsoft documentation pages and RFC 8914 settled the smaller technical claims.

The first-hand checks ran between 10:13 and 10:20 UTC on October 24. We pulled registration records for all 20 names through the IANA RDAP bootstrap (Identity Digital for .info, CentralNic for .xyz), queried A records on both resolvers’ DNS-over-HTTPS JSON interfaces with and without DNSSEC checking, queried DS and DNSKEY records on Cloudflare’s, computed key tags from the DNSKEY records that exist, and looked up the returned addresses in ARIN and RIPE records. We did not install or run Popcorn Time, did not contact any of the 20 domains, and did not reach Eye or Shadowserver; we found no statement from either beyond what is cited. The 250,000 and 4.3 million figures and the four-fifths drop are our arithmetic on the post’s numbers.