Eye Security disables Time4Popcorn updater on 2 million devices

Eye Security disabled a dormant software updater on more than 2 million devices by March 2026. The updater belonged to Time4Popcorn, a fork of the Popcorn Time streaming application that had not received development updates for years.

The team identified the active updater on Windows, macOS, and Android systems worldwide. The software contacted web domains that had been abandoned and used unencrypted HTTP for these connections. It also relied on an outdated version of the Chrome browser engine.

Niels Teusink of Eye Security stated that the vulnerability allowed an attacker to install and run software with full privileges. An attacker could have recruited these machines into a botnet by taking over one of the abandoned domains or by using a man-in-the-middle attack to target specific devices. The setup also allowed for surveillance by identifying which machines were running the software.

The researchers registered one of the abandoned domains themselves. They used it to deliver an update that instructed the updater to disable itself. The team acknowledged ethical concerns about modifying user systems without explicit consent. They noted that the alternative was to do nothing and that the update process was only creating risk without providing any functional benefit.

On Windows computers, the update stopped and disabled the service via the Service Control Manager. It did not delete files or make other changes. On macOS, a shell script ran a command to prevent the update process from starting. The team did not address Android devices because installing an update on that platform would still require action from the user.

The team had to adjust the update after uploading it to VirusTotal. Security programs flagged the original version as malware and blocked it. This left the vulnerable updater running on machines where the update was blocked. By March, Eye Security had sent out over 2 million update downloads. The company then transferred the domains it had used to the Shadowserver Foundation.

The total number of devices at risk remains unclear. The company stopped distributing the update in March after delivering the patches. The domains used for the update were transferred to a web security non-profit following the completion of the distribution.