Eye Security forces silent update on 2 million computers to stop old movie app

Eye Security pushed a silent update to over 2 million Windows, macOS, and Android devices in early 2026. The update targeted a dormant component of Time4Popcorn, a fork of the movie streaming software Popcorn Time. The company acted to stop the updater from contacting abandoned web servers.

Popcorn Time was a popular front end for torrenting films and television in the 2010s. The app attracted criticism from the MPAA but stopped receiving development years ago. Despite the lack of maintenance, copies of the software remain installed on millions of machines. Eye Security researchers discovered that the updater for the Time4Popcorn version was still active on these devices.

The updater communicated with web domains that no one owned anymore. It did so over unencrypted HTTP and relied on an outdated version of Chrome. Niels Teusink, a researcher at Eye Security, said the weakness allowed an attacker to install and run any software with full privileges. An adversary could have built a botnet by taking over one of the abandoned domains. They could also have targeted specific computers through a man-in-the-middle attack or identified which machines ran the software for surveillance.

The team chose to register one of the abandoned domains themselves. They used it to deliver an update that told the updater to disable itself. The researchers acknowledged ethical concerns about forcing changes on user devices. They stated the only alternative was to do nothing. Teusink noted that the update process was not doing anything functional and was only creating risk for users.

The Windows update stops and disables the service via the Service Control Manager. It does not delete files or make other changes. On macOS, a shell script runs a command that prevents the update process from starting. The team did not address Android devices because installing an update there still required user action. The update had to be adjusted after being uploaded to VirusTotal. Security programs flagged the original version as malware and blocked it, leaving the vulnerable updater running on those machines.

Eye Security sent out over 2 million update downloads by March, when it stopped distributing the update. The company then transferred the domains it had used to the Shadowserver Foundation, a web security non-profit. The total number of devices at risk remains unclear.

The dormant updater now sits disabled on the devices that received the patch. The abandoned domains are no longer controlled by the security firm. The software remains installed on user machines, but the active connection to the internet has been cut.