Two Million Devices Receive Dormant App Patch

Eye Security disabled a dormant software component on millions of devices in October 2026.

The component belonged to Time4Popcorn, a fork of the Popcorn Time streaming application. Popcorn Time was a front end for movie and TV torrents that drew attention from the MPAA in the 2010s. Development stopped years ago, but copies remained installed on Windows, macOS, and Android systems.

Researchers identified that the Time4Popcorn updater was still active on a large number of machines. It contacted abandoned web domains over unencrypted HTTP and relied on an outdated version of Chrome. Niels Teusink of Eye Security stated that the updater could have installed and run software with full privileges. An attacker could have built a botnet by taking control of one of the abandoned domains or targeted specific devices through a man-in-the-middle attack. Surveillance was also possible by identifying which machines ran the software.

The team registered one of the abandoned domains and delivered an update that instructed the updater to disable itself. They acknowledged ethical concerns but noted the alternative was to do nothing. They added that the update process was not functional and only created risk. On Windows, the update stopped and disabled the service via the Service Control Manager without deleting files. On macOS, a shell script prevented the update process from starting. Android devices were excluded because installing an update required user action.

The team adjusted the update after uploading it to VirusTotal. Security programs flagged the original file as malware and blocked it, which left the vulnerable updater running on those machines.

Eye Security sent out over 2 million update downloads by March, when it stopped distributing the update. The company then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit.