Apps & Software

Abandoned Popcorn Time Apps Disabled to Prevent Botnet

Security researchers have intervened to disable an abandoned updater for the popular piracy streaming software, averting a massive potential botnet threat across millions of active installations.

Radwan AbdulhadiEditor and technology writer

Published: October 24, 2026 · Updated: October 24, 2026 · 3 min read

Abandoned Popcorn Time Apps Disabled to Prevent Botnet — Image: The Verge

A Forgotten Streaming Legacy

During the 2010s, the application known as <a href="https://www.theverge.com/2015/10/23/9603070/popcorn-time-movie-piracy-app">Popcorn Time</a> gained massive popularity as an easy-to-use front end for streaming torrents of television shows and movies, frequently drawing the ire of the MPAA. Although official development of the software has been <a href="https://www.theverge.com/2015/10/23/9600576/popcorn-time-history-timeline">abandoned for years</a>, millions of devices around the world still retain active installations of the application.

According to a recent disclosure by <a href="https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/">Eye Security</a>, researchers found that the updater for a specific Popcorn Time fork named "Time4Popcorn" was still running on numerous Windows, macOS, and Android systems. The application continued to phone home to web domains that had long been abandoned, utilizing unencrypted HTTP connections alongside an insecure, outdated version of the Chrome browser.

Vulnerabilities and Botnet Risks

Niels Teusink of Eye Security explained that the lingering updater presented a severe cybersecurity risk. Because of how the application functioned, malicious actors could have leveraged the updater to install and execute virtually any kind of software with full system privileges.

An attacker could have easily achieved this by taking over one of the abandoned domains, executing a man-in-the-middle attack targeted at specific devices, or performing surveillance to identify which machines were actively running the vulnerable software.

Intervention and Mitigation Strategy

Faced with the prospect of an enormous zombie bot army, the security researchers formulated a remediation plan. Their solution involved registering one of the abandoned domains themselves and utilizing it to dispatch an update designed solely to disable the updater component.

While acknowledging potential ethical concerns regarding the intervention, the team stated that their only alternative "was to do nothing." They emphasized that the underlying update process was no longer serving any functional purpose and was merely compounding risk for everyday users.

Platform Execution and Handover

Eye Security detailed that on Windows devices, their remediation update simply stopped and disabled the vulnerable service via the Service Control Manager without deleting any personal files. For macOS users, the mitigation deployed a shell script to execute a command blocking the update process from launching.

The researchers did not explicitly detail automated fixes for Android devices, noting that installing updates on that mobile operating system would still require user interaction. The team was also forced to adjust their update script after it was uploaded to VirusTotal, which caused security programs to mistakenly flag the patch as malware.

Although the exact total of vulnerable machines remains unclear, Eye Security confirmed it sent out over two million update downloads by March. At that point, the team halted active distribution and transferred control of the domains to the <a href="https://www.shadowserver.org/">Shadowserver Foundation</a>, a web security non-profit organization.