Two Million Devices Patched to Stop Silent Risk from Abandoned Movie App
Security researchers disabled a dormant updater for Popcorn Time after finding it could allow attackers to install software on Windows, Mac, and Android systems.
By Thomas Obasi ·
Millions of computers and phones around the world ran a hidden piece of software that could have allowed attackers to install programs without user permission. Eye Security researchers identified the flaw in an updater for Time4Popcorn, a fork of the streaming application Popcorn Time. The company disabled the updater on Windows and macOS devices in March 2026.
Popcorn Time was a popular tool for streaming movies and TV shows via torrents in the 2010s. Development stopped years ago, but copies remained installed on many devices. The updater for Time4Popcorn continued to run in the background on Windows, macOS, and Android systems. It contacted abandoned web domains using unencrypted connections and relied on an outdated version of Chrome.
Niels Teusink of Eye Security stated that the vulnerability was severe. An attacker could have taken control of one of the abandoned domains to deploy a botnet. They could also have targeted specific devices through a man-in-the-middle attack or monitored which machines ran the software. The updater had full privileges, meaning it could install and run almost any program.
The researchers registered one of the abandoned domains and used it to push an update that told the software to disable itself. They acknowledged ethical concerns about this method but noted the alternative was to take no action. Teusink said the update process was not functional and only created risk for users.
On Windows, the update stopped and disabled the service through the Service Control Manager without deleting files. On macOS, a shell script prevented the update process from starting. Android devices were not automatically updated because the process required user action to install new software.
The team had to modify its initial update after security programs flagged it as malware. This blocked the patch on some machines, leaving the vulnerable updater active. Eye Security distributed over 2 million update downloads by the time it stopped the process in March 2026. The company subsequently transferred the domains it used to the Shadowserver Foundation, a web security non-profit.
