Eye Security Disables Popcorn Time Updates on 2 Million PCs

Two million computers running the streaming application Popcorn Time received unauthorized software deployments from Dutch cybersecurity firm Eye Security to disable a vulnerable update mechanism, according to an October 22, 2026 report.

Targeting Time4Popcorn

The intervention zeroes in on Time4Popcorn. That platform is a fork of the media-streaming software also distributed as Popcorn Time. A public warning issued by Eye Security in June flagged a vulnerability inside the application’s update system. Because the software is no longer supported, no official security patch was forthcoming. The flaw allowed attackers to push malicious updates and infect user systems with malware.

Unsecured Channels Allow Malicious Code on Client Devices

The flaw lived in the updater’s communication with update servers over an unsecured channel. Anyone capable of manipulating network traffic between the application and the server could force malicious code onto client devices. Eye Security found the updater connected to multiple domains, leaving infrastructure exposed. While the firm successfully registered one previously unclaimed domain, third parties had already acquired several others. To mitigate the risk, the cybersecurity company ultimately purchased a number of those domains itself.

Telemetry data collected during the investigation points to an active footprint of roughly 2.5 to 3 million Windows computers running Popcorn Time. Another 250,000 to 350,000 Mac devices also run the software.

Weighing the Ethics of Remote Modification

Faced with the massive exposure and zero active vendors, Eye Security debated whether executing remote software modifications on millions of private machines without explicit user consent was permissible. The firm drew parallels to Operation Ladybird, an initiative by the Dutch police that deployed software to infected computers to eradicate active botnet malware.

“These clients are nooit bewust onderdeel van een botnet geworden, terwijl deze gebruikers de software vermoedelijk vrijwillig installeerden,” Eye Security stated, highlighting that users chose the media player but never consented to running an unmaintained background updater controlled by arbitrary third-party domain holders. “Met miljoenen kwetsbare systemen en software die niet meer wordt beheerd, was er geen leverancier om het te verhelpen en geen patch onderweg: als wij niets deden, zou niemand iets doen.”

Update Script Disables Background Processes on Millions of Systems

Before deployment, the company tested the update and ensured the modification was easily reversible. The deployed script disables the Popcorn Time update service on Windows systems and terminates the update process on macOS.

Antivirus vendors initially flagged the mitigation software as malware shortly after its release, forcing Eye Security to adjust its code to bypass the antivirus signatures. Between November of last year and March of this year, the update script to disable the background process was distributed more than two million times.

Popcorn Time continues to function on those systems after the updater is disabled, but users have been advised to uninstall the software entirely. The application relies on a 2014-era Chrome engine with disabled sandbox protections, and previously loaded JavaScript directly from abandoned domains. Eye Security has handed over all domains it registered, as well as those captured during the response, to The Shadowserver Foundation.