This abandoned torrent app could have exposed millions of devices to a cyberattack
follow us
Add us as a preferred source on Google
- Researchers say an abandoned Popcorn Time app could have allowed malware to be delivered to millions of devices through insecure updates.
- The flaw allowed anyone controlling an inactive update domain to send executable code to connected systems
- Security researchers safely disabled the updater, preventing a potential compromise of millions of Windows and macOS devices.
Security researchers recently discovered an abandoned torrent app that could have been used to deploy malware to millions of devices around the world quite easily.
Fortunately, it appears that no threat actors discovered this vulnerability and researchers were able to legally close it and keep devices secure.
Popcorn time
A “torrent” is a popular way to download large files quickly: rather than hosting the files on a single server and risking slow download speeds and downtime, the hosting is split across numerous nodes on a network. Next, a small torrent (.torrent) file is created (typically about 100 kb), which contains information about where the large file is hosted.
Latest videos ofTechnologyRadar
Users can then download and run it through a specialized torrent client (basically, a computer program). The client then connects to as many nodes as it can and downloads small chunks of the large file at the same time, significantly speeding up the download time.
The use of torrents became very popular among cybercriminals and people looking to pirate copyrighted content (movies, commercial software, games). However, for many people, especially those who were not tech-savvy, the process was quite cumbersome. Downloading a client, finding a torrent file, then downloading the actual file and running it in a separate application was too much for many, resulting in the creation of Popcorn Time.
This app looked like Netflix, but instead of streaming from the company’s servers, it streamed movies directly from torrents. It became very popular about 10 years ago because it made watching pirated content remarkably easy. However, it was soon closed, following legal pressure from the film industry. But since it was open source, many spin-off products soon emerged, including Time4Popcorn.
Critical defect
This was eventually abandoned, but many people keep it installed on their computers and that’s where the problems start.
These clients, installed on millions of computers, came with an updater that attempted to connect to the abandoned application domain ‘popcorntimeupd.xyz’ over unencrypted HTTP and accepted any executable found there without verifying the digital signature. This is a vulnerability now tracked as CVE-2026-30612, with a severity score of 9.8/10 (critical).
In theory, a threat actor could have obtained the domain and used it to send a malicious update to anyone who still had the app installed on their device. In practice, this was done by security researchers Eye Security. They registered the missing domain and saw up to 3 million connections from Windows and 350,000 macOS clients to Time4Popcorn: residential ISPs, government and military networks, corporate devices. Everyone had the app installed but apparently didn’t use it. Eye Security believes it was installed at some point and simply forgotten about.
“If we could push an update, we could run code on millions of systems,” Eye Security said, emphasizing that “the impact would be severe if this fell into the wrong hands.”
But instead of deploying malware, Eye Security wrote and pushed code that stopped and disabled the updater. It did not remove the app from people’s computers, nor did it collect host data or telemetry; it simply told the app not to check for more updates.
It took researchers from November 2025 to March 2026 to push the update to almost all computers and now, requests to the update domain have dropped by 98%. The remaining 2% appears to fall on Android devices, which apparently remain at risk.
Eye Security deemed the remediation operation a success, after which it transferred ownership of the domain (as well as 14 others it acquired) to The Shadowserver Foundation. He urged everyone to uninstall the app from their devices immediately as it poses a significant security risk.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment