2 million devices patched to kill silent updater
A dormant component for an old streaming tool could have allowed attackers to install software on Windows, Mac, and Android systems.
By Petra Murphy ·
By March 2026, a security team had distributed 2 million updates to disable a dormant software component.
The target was the updater for Time4Popcorn, a version of the movie streaming app Popcorn Time. Popcorn Time gained notoriety in the 2010s when the MPAA sued its developers. Although the project stopped receiving development years ago, copies remain installed on millions of devices worldwide.
Eye Security researchers discovered that the Time4Popcorn updater was still active on Windows, macOS, and Android systems. The component contacted web domains that were no longer maintained. It sent data over unencrypted HTTP and used an outdated version of Chrome. Niels Teusink of Eye Security explained that this setup allowed the updater to install and run any software with full privileges. An attacker who seized control of one of the abandoned domains could have recruited these machines into a botnet. They could also have used man-in-the-middle attacks to target specific devices or identify which users had the software installed.
To stop the threat, the researchers registered one of the abandoned domains themselves. They used it to send an update that told the updater to turn itself off. The team acknowledged ethical questions about forcing a change on user devices. They noted that the only other option was to do nothing. They also stated that the update process was not performing any useful function and was only creating risk.
The fix worked differently on each platform. On Windows, the update stopped and disabled the service through the Service Control Manager without deleting files. On macOS, a shell script ran a command to prevent the process from starting. The team did not address Android devices because installing an update there required manual user action. The original update package was flagged as malware by security programs after being uploaded to VirusTotal. This forced the team to adjust the code to ensure it reached the vulnerable machines.
Eye Security stopped distributing the update in March 2026. The company then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of devices that had the vulnerable software is unclear.
