Researchers neutralize 2 million vulnerable Popcorn Time updaters to prevent global botnet takeover
Security firm Eye Security seized abandoned web domains used by unencrypted Time4Popcorn updaters, pushing an automated kill-switch to prevent malicious actors from exploiting root-level services across millions of forgotten consumer PCs.
Technology news
Dutch cybersecurity firm Eye Security on Friday revealed an unprecedented remediation operation that successfully disarmed a dormant software vulnerability running on more than two million computers worldwide. The vulnerability resided inside the automated updater component of “Time4Popcorn,” a popular abandoned fork of the notorious 2010s torrent streaming application Popcorn Time. Despite the original software maintainers abandoning development years ago, the background update service remained installed and silently active across millions of consumer Windows, macOS, and Android devices.
Security researchers discovered that the Time4Popcorn updater executed continuously with maximum administrative privileges—running as SYSTEM on Windows and with root daemon rights on macOS—while routinely polling a list of hardcoded web domains over plain, unencrypted HTTP. Compounding the threat, the application incorporated an ancient, unpatched version of the Chromium browser framework containing dozens of publicly known remote code execution exploits. Any cybercriminal or nation-state group that acquired the expired domains could have executed arbitrary code with elevated privileges, silently converting millions of PCs into a distributed denial-of-service botnet or crypto-mining syndicate.
Confronted with an acute global threat and no active software vendor to issue a patch, Eye Security took the controversial ethical step of registering one of the abandoned update domains. The researchers engineered a custom update payload containing a benign neutralization script: on Windows systems, the update directed the Service Control Manager to halt and permanently disable the updater service without modifying personal files; on macOS, it deployed a shell script that removed background launch agents and revoked execution permissions.
Between late 2025 and March 2026, Eye Security delivered more than two million automated disable payloads to active endpoints before retiring the update server. To ensure permanent remediation, the security firm formally transferred ownership of the abandoned domains to the Shadowserver Foundation, a non-profit security collective that runs public sinkholes for botnet infrastructure. Security analysts praised the intervention as a textbook example of proactive threat disarmament, while noting that abandoned legacy software with persistent background services remains a severe systemic blind spot for global internet hygiene.