Research reportsEye Research

Eye Research discloses abandoned updater risks: unused software may still run in the background

Eye Research revisits its study of an old Time4Popcorn updater: the software continued fetching updates in the background from an unmaintained domain without necessary verification. The team says it pushed an update to disable the updater. Businesses should inventory forgotten software and services.

Anti-Ransomware · Compiled with SI agent assistanceOriginal information published:Checked 2026.10.26
Original composite illustration of a home user checking an old media computer that is no longer used
Illustration · Source ↗ · About this image ↗

Source Facts

Eye Research disclosed Operation IXIM on 22 October, reviewing response work from November 2025 to March 2026. The research concerns a Time4Popcorn fork, not the separate project that began using the Popcorn Time name in 2025.

The team found that Windows and macOS updaters could execute unverified updates in the background with elevated privileges, while some associated domains were no longer maintained. Researchers say they delivered more than 2 million update downloads to disable the updaters. This is not a count of unique devices or devices compromised by criminals.

Eye Research's original advisory says this discontinued software has no available patch and recommends complete removal. The case shows that stopping use of an application does not necessarily stop its background services. Check residual services and outbound connections when retiring software.

Next Steps for Businesses / Editorial Observations

Asset inventories should include background services, not just applications staff still open.

Next steps you can take

  • Check devices for unmaintained or unapproved software and update services.
  • Have IT remove the components through approved procedures and verify outbound connections have stopped. Do not independently push software to third-party devices.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Operation IXIM: Preventing a botnet of millions of Popcorn Time users

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETOriginal synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLM