An abandoned updater tucked inside a long-dead movie app has been quietly checking in from hundreds of thousands of Macs, and for years nobody was on the other end of the line. Anyone who registered the lapsed domains it called could have answered instead.
Eye Security documented the exposure this week under the name Operation Ixim. The helper belonged to Time4Popcorn, a fork of the BitTorrent streaming client that kept using the Popcorn Time name, and it ran at every system start whether or not the owner launched the app. Updates arrived over plain HTTP and executed with no signature check, catalogued as CVE-2026-30612.
The door nobody was watching
Because the project died years ago, the domains the helper reached simply expired. Registering one was enough to hand a Mac a payload with full permission to rewrite anything on disk. The firm describes a botnet waiting for an owner, with no abuse observed.
Eye Security seized an abandoned address and pushed an update that switched the mechanism off, counting 250,000 to 350,000 Macs carrying it plus roughly 2.5 million Windows machines. Owners never reinstalled anything; the cure arrived through the same channel as the risk.
By March 2026 downloads passed two million and traffic to the researchers’ domains fell 98 percent, after which 15 addresses went to the Shadowserver Foundation.
Switching off the update path closed one route, not the app. The desktop build still runs a 2014 Chrome engine with sandboxing disabled, and some addresses remain outside the researchers’ control. Anyone who installed a Popcorn Time fork in the past decade should check the Applications folder rather than assume silence means absence. A program that is gone can still be asking for instructions.
