Researchers remotely disabled abandoned Popcorn Time updaters to prevent botnet takeover

A dormant piracy app became a live security risk

Popcorn Time, the torrent-streaming application that gave pirated films and TV shows a Netflix-style interface in the 2010s, has been without active development for years. According to The Verge, however, it is still installed on millions of devices around the world, and much of that installed base continues to quietly run the app's update software.

Researchers at security firm Eye Security discovered that the updater shipped with a widely used fork of the app, Time4Popcorn, remains active on large numbers of Windows, macOS, and Android devices. The updater keeps contacting web domains that were long ago abandoned by their owners, does so over unencrypted HTTP, and embeds an obsolete, insecure build of Chrome.

Niels Teusink of Eye Security told The Verge that the updater could have been coerced into installing and running essentially any software with full privileges on an affected machine.

How the takeover would have worked

The researchers laid out three exploitation paths. Registering one of the lapsed domains would have given an attacker control over what the updater installs. The unencrypted HTTP traffic could have been intercepted in a man-in-the-middle attack to single out particular devices. And the update traffic itself could have supported surveillance by identifying which machines were running the software.

Because so many machines run the same updater with elevated permissions, a single expired domain registration was effectively all that separated this dormant app from a botnet spanning millions of devices.

A self-destructing update, pushed without permission

Eye Security's remedy was unusual: rather than simply publishing a warning, the researchers registered one of the abandoned domains themselves and used it to deliver an update instructing the updater to disable itself.

The move raises obvious ethical questions, since it meant shipping code to computers the researchers did not own. They argued the alternative "was to do nothing," and that "the update process wasn't doing anything functional anyway, it was only creating risk for users."

The mechanics differed by platform. On Windows, Eye Security says its update "simply stops and disables the service via the Service Control Manager" and deletes nothing. On macOS, a shell script blocks the update process from launching again. The researchers did not extend the fix to Android, where installing an update still requires direct interaction from the user.

The intervention also hit a snag once the update was uploaded to VirusTotal. Security products began flagging it as malware, which blocked the fix while leaving the vulnerable updater in place, so Eye Security had to modify the update to work around the detections.

The exact number of exposed devices is unknown. By March, when Eye Security stopped distributing the fix, it had delivered more than 2 million update downloads. The researchers then transferred the domains they had used to the Shadowserver Foundation, a web security non-profit that now controls the infrastructure.

Why it matters

Abandoned software does not uninstall itself. This episode is a rare, well-documented case of security researchers intervening directly against a dead application, and it illustrates a broader problem: auto-update mechanisms left pointing at infrastructure nobody maintains. Anyone can register an expired domain, and an updater that accepts whatever a domain serves over plain HTTP turns each neglected registration into a potential mass compromise.

The story also exposes the awkwardness of the cure. Code pushed to other people's machines without consent looks exactly like malware to antivirus engines, which is precisely what happened on VirusTotal, even when the payload is remediation rather than attack.

For users, the practical lesson is straightforward: when a project dies, its leftovers keep running, and old streaming tools, updaters, and background services are worth auditing and removing. For developers shutting down a product, cleanly disabling the update channel, or handing domains to a trusted custodian as Eye Security did with Shadowserver, should be treated as part of shutting down responsibly.