Malware · Threat Intelligence
Researchers remotely disable risky Popcorn Time updater on millions of PCs
Security researchers pushed over 2 million updates to disable an abandoned Popcorn Time updater that could have let attackers take over users' computers. The fix targeted a risk affecting millions of Windows and Mac machines.
Ross Grant3 min read
The short version
A security company found that an old updater for the Popcorn Time app could let attackers take over millions of computers. Since the app's makers no longer exist, the researchers sent updates themselves to turn off the risky updater. This stopped attackers from using it, but the Popcorn Time app itself is still unsafe. Users are advised to uninstall the app completely.
By the numbers
- 2 million+updates pushed by researchers to disable the updaterThe Hacker News
- 2.5–3 millionestimated Windows computers affectedThe Hacker News
- 250,000–350,000estimated Macs affectedThe Hacker News
- 98%reduction in update traffic after actionThe Hacker News
What happened?
Researchers at Eye Security pushed over 2 million updates to remotely disable an abandoned updater for the Time4Popcorn app between November 2025 and March 2026. The updater could have allowed attackers to take control of millions of Windows and Mac computers. The company acted because no vendor remained to fix the issue. According to The Hacker News, the risk affected both home and organisational networks worldwide.
Who is affected
Between November 2025 and March 2026, Dutch security firm Eye Security found and addressed a security risk in Time4Popcorn, an abandoned version of the Popcorn Time app. The updater component, called Updater.exe on Windows and PT.updd on Mac, was still running on an estimated 2.5 to 3 million Windows computers and 250,000 to 350,000 Macs. The affected computers included home users worldwide, as well as some on government, military, and corporate networks, according to Eye Security. The original Popcorn Time project shut down in 2014, but copies like Time4Popcorn remained in use. A new, unrelated legal project with the same name started in 2025, but was not affected.
How the flaw works
The updater ran in the background from system startup, checking for updates by contacting a web address that was no longer registered. It installed any software it received, with full system privileges (SYSTEM on Windows, root on Mac), and did not verify who sent the update. This meant anyone who registered the abandoned domain could push code to every machine still running the updater. Eye Security registered the domain and saw about 50 connection requests per second, later tracking over 3.8 million unique hardware IDs (though this overcounted the number of devices).
The response
With no company left to fix the software, Eye Security decided to act. After legal consultation, they pushed over 2 million updates to disable the updater, preventing it from being used to take over machines. The update did not delete files or collect data. The firm compared this to Operation Ladybird, when Dutch police disabled the Emotet botnet in 2021, but noted that Popcorn Time users had installed the app themselves. Eye Security's update was initially flagged as malware by antivirus products, but they adjusted it until only one scanner still flagged it. By March 2026, update traffic had dropped by 98%. Eye then handed control of the domains to the Shadowserver Foundation, a non-profit that manages abandoned and malicious domains.
What you should do
Eye Security recommends uninstalling Popcorn Time entirely, as disabling the updater does not address other security risks in the app. The app uses an outdated browser engine with its security sandbox turned off, loads content over unencrypted connections, and can pull in code from other abandoned domains. On Windows, users can disable the updater with two commands to stop and disable the "Update service"; on Mac, a single command can unload the helper. On Android, the updater is built into the app and cannot be disabled separately. Removing the app is the safest option. Network defenders can look for the updater files and traffic to the listed domains to identify affected systems. The Hacker News (opens in a new tab)
This story is based on a single report from The Hacker News. No primary sources or vendor confirmation are available yet. Eye Security found no evidence that anyone else had exploited the updater, but some domains remain outside their control, so some machines could still be at risk.
Why it matters
Millions of computers were exposed to remote takeover because of an abandoned updater. The case shows how forgotten software can create lasting risks, even years after its original use. It also raises questions about the ethics and legality of researchers acting directly to protect users.
Key points
- Researchers disabled a risky updater on over 2 million computers.
- The updater could have let attackers install malware with full privileges.
- No official vendor remained to fix the flaw, so researchers acted directly.
- Popcorn Time itself remains unsafe and should be uninstalled.
- Some domains remain uncontrolled, so some risk persists.
Sources
The Hacker News
Reference
