The open‑source torrent streamer Popcorn Time was abandoned years ago, yet a fork called Time4Popcorn keeps an updater running on Windows, macOS and Android devices. Eye Security, a security‑research firm, discovered that the updater contacts now‑defunct domains over plain HTTP and relies on an outdated Chrome engine, exposing millions of installations to potential abuse.
How the updater works
When the application is launched, the updater checks for new versions by reaching a hard‑coded domain. Because the connection is unencrypted, a man‑in‑the‑middle attacker could intercept the request, inject malicious code or redirect the device to a hostile server. The updater runs with full system privileges, meaning any payload delivered through it could install arbitrary software, create a botnet or conduct surveillance on the host machine.
The risk for everyday users
Most users are unaware that the software remains on their computers. Even though the original Popcorn Time project stopped development, the fork continues to be distributed through third‑party sites. Devices that still have the updater active can inadvertently become part of a zombie army, a scenario the researchers describe as a “zombie army” waiting for a command.
What the researchers did
Eye Security’s Niels Teusink explains that the only practical mitigation was to take control of one of the abandoned domains. By registering it, the team could push a custom update that tells the service to stop. The Windows version simply disables the service via the Service Control Manager, while the macOS variant runs a shell script that blocks the updater from starting again. Android was not addressed because installing the update still requires user interaction.
The team uploaded the neutralising update to VirusTotal, but antivirus products flagged it as malware, forcing a tweak to avoid detection. By March, the researchers had distributed more than two million of these updates before handing the domains over to the Shadowserver Foundation, a non‑profit that monitors internet security.
What users should check
If you ever installed Popcorn Time or any of its forks, verify whether the Time4Popcorn updater is present. On Windows, look for a service named Time4Popcorn in the Service Control Manager; on macOS, inspect launch agents or daemons that reference the updater. Removing the service or deleting the application altogether eliminates the lingering risk.
The episode highlights how abandoned software can become a hidden attack surface long after development stops, reminding users to audit old programs and keep their systems clean.