Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
-
Between November 2025 and March 2026, researchers at the Dutch security firm Eye Security remotely pushed more than 2 million updates to computers they did not own. The goal was to disable a background updater bundled with Time4Popcorn, an abandoned fork of the defunct Popcorn Time application, which was once widely used to stream pirated films and TV shows over BitTorrent.
According to the firm, the updater represented a serious risk: because it periodically fetched and applied updates from an external source, an attacker who gained control of that channel could have used it to deliver malicious code and take over affected machines, potentially conscripting them into a botnet. Rather than leave the abandoned software exposed, Eye Security intervened directly and issued the updates itself to switch the updater off.
Key details:
- The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time
- The operation ran from November 2025 to March 2026
- More than 2 million updates were pushed to devices not owned by the researchers
- The concern was that the updater could have enabled an outsider to seize control of the machine and fuel a botnet
Note: The article does not specify a CVE identifier or advisory ID for this issue.
Source: The Hacker News
Have you ever encountered abandoned updater components like this on endpoints in your environment, and how does your team detect them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login