Time4Popcorn CVE-2026-30612: Supply Chain Risk from Abandoned Update Domains to SYSTEM/Root Code Execution

1. Basic Information

• Article: Operation IXIM: Preventing a botnet of millions of Popcorn Time users
• Published by: Eye Security
• Date: 2026-10-22
• Original: Eye Security
• Related Sources: Eye Security: CVE-2026-30612 advisory, BleepingComputer
• Malware: Unspecified
• Threat Actor: Unspecified
• CVE: CVE-2026-30612
• Products: Time4Popcorn, Updater.exe, PT.updd
• Severity: High
• Severity Justification: Millions of remaining installations and high-privilege automatic update paths allow large-scale code execution via domain hijacking or network tampering. Because there is no vendor and no official patch, uninstallation is required.

2. Summary in One Sentence

The abandoned Time4Popcorn update feature downloads and executes files without signature verification, running as SYSTEM on Windows and root on macOS. Researchers attempted to disable updates via over two million update downloads, but this does not indicate unique device counts or the security status of all devices.

3. Attack Flow

Prerequisites vary by operating system. Android is a separate pathway requiring user interaction, not a subsequent stage to Windows and macOS.

Background Updates on Windows and macOS

1. Remaining update programs on the device (Updater.exe on Windows, PT.updd on macOS) connect to the update domain via plaintext HTTP.
2. An attacker who controls the update domain, or a man-in-the-middle capable of tampering with traffic along the path, responds with a download URL for a malicious executable.
3. The downloaded executable runs automatically without signature verification with SYSTEM privileges on Windows and root privileges on macOS. Researchers used this path to distribute code that halts and disables the update feature.

Separate Android Pathway

1. Unlike background automatic updates on Windows and macOS, updates are checked only when users explicitly launch the application.
2. Installing the provided APK file requires interactive user consent. The update logic is built into the main app, and researchers have not distributed updates to disable the updater on Android.

4. Attacker Position and Execution Location

• Anyone who has acquired the update domain or a network attacker capable of tampering with plaintext HTTP traffic.

5. Visibility for Victims and Administrators

Victims

• The background updater runs without clear notifications even after years of disuse.

Administrators and SOCs

• Can be observed as HTTP connections, downloads, and process execution originating from high-privilege services or launch daemons.

6. Success and Failure Conditions

Success Conditions

• The updater remains present and an attacker controls the domain or network path.
• The response is received and the payload is executed on Windows or macOS.

Failure Conditions and Mitigations

• Completely uninstall the application and check for Windows services, macOS launch daemons, and remaining files.
• Merely stopping the update feature does not resolve risks in the application itself, such as an outdated Chromium engine or disabled sandboxing.
• Inference: Controlling traffic to the update domain is a temporary exposure reduction. Some domains have been transferred to Shadowserver, and the mere presence of traffic does not confirm malicious distribution or successful compromise.

7. Impact of Success

• Code execution as SYSTEM on Windows or root on macOS.
• Stepping stone for credential theft, botnets, or ransomware.

8. Observable Logs

Inference: The following items are candidates for investigation within your organization. Availability depends on products, configurations, permissions, and retention periods, and they are distinct from logs observed in the source. A single trace alone does not confirm a successful compromise.

• Email: None
• Proxy / SWG / DNS: HTTP/DNS traffic to update domains listed in the original text, such as popcorntimeupd[.]xyz. Review historical ownership, timestamps, and response contents.
• Endpoint / EDR: Updater.exe, PT.updd, and high-privilege child processes.
• Identity / IdP: None
• SaaS / Cloud: None
• Network: Update checks and executable file downloads via plaintext HTTP.

9. Determining Attack Success

Confirmed in Public Information

After validation and phased deployment, Eye Security executed code to disable the updater on Windows and macOS. The figure of over two million represents update download counts, and the 98% reduction refers to requests directed to domains managed by the company. These downloads and the researchers' intervention do not represent a count of compromises by malicious third parties.

Criteria for Your Organization

• Attack Attempt Observed (Success Unconfirmed) (contact_only): Criteria: HTTP/DNS update checks alone may indicate normal update checks or sinkhole traffic. Confirm evidence such as malicious responses or payload distribution to classify as an attack attempt.
• Initial Execution Confirmed (initial_execution): Criteria: Link malicious update responses and downloaded files to execution records under SYSTEM or root privileges. Distinguish between code distributed by the researchers to disable the updater, legitimate files, and malicious payloads.
• Subsequent Compromise Confirmed (follow_on_compromise): Criteria: Independently confirm evidence of credential theft, C2, persistence, or lateral movement following malicious code execution.

10. Investigation Playbook

• Trigger: Time4Popcorn indicators, communication with listed domains, or high-privilege updaters.
• Initial Checks: Verify file paths, services, launch daemons, and hashes. Preserve proxy, DNS, and EDR timelines.
• Endpoint: Check process trees, file modifications, crashes, and persistence mechanisms.
• Identity / Cloud: Review usage histories of credentials, API keys, and service accounts held or used by the target system.
• Follow-On: Check for C2, credential access, and lateral movement.
• Containment: Completely remove after network isolation, and rotate credentials if signs of compromise are found.
• Classification: Distinguish between reach/attempts only, initial execution or successful authentication, information access, and subsequent compromise; do not judge your own organization as successfully compromised based solely on research demonstrations or public PoCs.

11. Defense and Detection Ideas

• Single Event: Launch of unknown files from updaters or HTTP traffic to listed domains.
• Time Series: Updater -> download -> SYSTEM/root child process -> outbound traffic.
• Hunting: Search by file path and hash, including long-unused devices and BYOD endpoints.
• Logging Gaps: Without historical HTTP bodies, it is difficult to distinguish between update checks and payload downloads.
• Priority Controls: Software removal, domain blocking, and EDR threat hunting.

12. Facts, Inference, and Hypothesis

Facts

• Windows and macOS updaters connect to abandoned domains via plaintext HTTP and launch downloaded files with high privileges without signature verification.
• Eye Security estimated approximately 2.5 to 3 million Windows devices and 250,000 to 350,000 macOS devices, accounting for duplication and fluctuation of the hid identifier. These are not confirmed victim counts.
• Through operations between November 2025 and March 2026, they provided over two million update downloads and reported a 98% decrease in update requests to company-managed domains as of March 1. Download counts do not represent unique device counts or successful disablement counts.
• 15 domains were transferred to Shadowserver, but risks such as third-party-owned domains, Android, and 2014-era Chromium engines with disabled sandboxes remain.
• Researchers executed code to stop and disable update functionality on Windows and macOS. This is not a report demonstrating malicious payload distribution or actual damage by third parties, and the recommendation is complete uninstallation of the application.

Inference

• Do not rely on users reporting that they installed the software; also search hashes, file paths, services, and DNS history.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under Unresolved Questions and Further Investigation.

13. MITRE ATT&CK Mapping

14. Unresolved Questions and Further Investigation

• The current status of untransferred domains, the number of unreached unique devices, successful disablement on each device, and historical malicious usage remain undetermined.

15. Impact on SOCs and Organizations

Organizations should locate remaining installations using file paths, services, hashes, and DNS history, and remove the application completely rather than only stopping the updater.

16. Key Points by Audience

• SOCs: Hunt for Updater.exe, PT.updd, listed domains, and high-privilege processes.
• Administrators: Completely uninstall Time4Popcorn and verify remaining services and files.
• General Users: Do not launch Time4Popcorn and remove it completely.