<![CDATA[Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet]]>Between November 2025 and March 2026, researchers at the Dutch security firm Eye Security remotely pushed more than 2 million updates to computers they did not own. The goal was to disable a background updater bundled with Time4Popcorn, an abandoned fork of the defunct Popcorn Time application, which was once widely used to stream pirated films and TV shows over BitTorrent.

According to the firm, the updater represented a serious risk: because it periodically fetched and applied updates from an external source, an attacker who gained control of that channel could have used it to deliver malicious code and take over affected machines, potentially conscripting them into a botnet. Rather than leave the abandoned software exposed, Eye Security intervened directly and issued the updates itself to switch the updater off.

Key details:

  • The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time
  • The operation ran from November 2025 to March 2026
  • More than 2 million updates were pushed to devices not owned by the researchers
  • The concern was that the updater could have enabled an outsider to seize control of the machine and fuel a botnet

Note: The article does not specify a CVE identifier or advisory ID for this issue.

Source: The Hacker News

Have you ever encountered abandoned updater components like this on endpoints in your environment, and how does your team detect them?

]]>https://xploitlk.com/topic/774/researchers-push-over-2-million-updates-to-remotely-disable-popcorn-time-updater-that-could-fuel-a-botnetRSS for NodeTue, 27 Oct 2026 07:25:05 GMTSat, 24 Oct 2026 10:30:17 GMT60