GoKawiilSecurity researchers disable abandoned Popcorn Time updater to block botnet risk
Eye Security found that the update mechanism for a Popcorn Time fork called Time4Popcorn was still active on millions of Windows, macOS, and Android devices, communicating with defunct domains over unencrypted HTTP using an outdated, vulnerable version of Chrome. The researchers registered one of the abandoned domains and pushed an update that disabled the service on Windows and macOS, rather than leave the exposed updater running. They said the update process served no real function anymore and only posed a security risk.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how long-dead software can remain a live security threat years after development stops, since insecure update mechanisms left phoning home to abandoned domains can be hijacked by anyone who claims those domains. Eye Security's researcher Niels Teusink suggests such a flaw could have let attackers build a botnet, run man-in-the-middle attacks, or surveil devices, though the firm says it chose to intervene rather than risk malicious actors doing so first. The episode also shows the practical tension security researchers face when their own fixes get mistakenly flagged as malware by detection tools like VirusTotal.
- Time4Popcorn, a Popcorn Time fork, left an insecure updater running on millions of devices despite the app's development being abandoned.
- Eye Security took control of an orphaned domain to push a self-disabling update rather than risk exploitation by attackers.
- The fix drew ethical scrutiny and was briefly flagged as malware by VirusTotal, complicating its rollout.
Source: theverge.com — Stevie Bonifield, 2026-10-23
Published there as: “Abandoned Popcorn Time apps had to be disabled to prevent a zombie army”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.