---
title: Hunt: sweep endpoints for the forgotten Popcorn Time updater (Updater.exe "Update service" on Windows, PT.updd on macOS) and remove the app | ctxsec
url: https://ctxsec.com/items/hunt-time4popcorn-updater-service-pt-updd
description: ""
status: "hunt guidance from Eye Security's advisory; file paths and service name are Eye's"
published: 2026-10-24
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-time4popcorn-updater-service-pt-updd.md)

hunt guidance from Eye Security's advisory; file paths and service name are Eye's

2026-10-24

### Hunt: sweep endpoints for the forgotten Popcorn Time updater (Updater.exe "Update service" on Windows, PT.updd on macOS) and remove the app

Eye Security's data shows the vulnerable Time4Popcorn updater on corporate and government networks, usually on machines where nobody uses the app anymore.

- **Windows:** a service named `Update service` running `C:\Program Files (x86)\Popcorn Time\Updater.exe` or `C:\Program Files\Popcorn Time\Updater.exe`. Query your EDR or software inventory for that path and service name.
- **macOS:** `/Library/PrivilegedHelperTools/PT.updd` with `/Library/LaunchDaemons/PT.updd.plist`.
- **Network:** DNS or proxy hits for `popcorntimeupd.xyz` and the other update domains listed in Eye's write-up.
- **Fix:** uninstall the app. If you need a stopgap, Eye gives `sc.exe stop "Update service"` then `sc.exe config "Update service" start= disabled` on Windows, and `launchctl unload -w /Library/LaunchDaemons/PT.updd.plist` on macOS. Android installs can only be removed.

Same lesson applies beyond this app: any unsigned, plain-HTTP auto-updater pointed at a domain that can lapse is a remote-code-execution path waiting for a buyer.

Sources: [Eye Security: CVE-2026-30612, a vulnerability in Time4Popcorn (PopcornTime)](https://research.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/)