Abandoned Popcorn Time Fork Exposed Millions of Devices to Remote Attacks

A Popcorn Time vulnerability could have let strangers run code with the highest privileges on millions of Windows and Mac computers. The flaw sat in the updater of Time4Popcorn, an abandoned, closed-source fork of the BitTorrent streaming app, and many of the machines running it may belong to people who forgot they installed it. Researchers at Eye Security found the problem and have since shut the updater off remotely. The catch is that no patched version exists, so removing the app is the only clean fix.

What the Time4Popcorn flaw could have allowed

Coverage dated October 23 and 24 laid out the research, and the story was still moving through security news on October 25 and 26. In its report, BleepingComputer quoted Eye Security’s researchers: “If we were able to send an update, we could potentially get code execution on millions of systems.” That sentence explains the stakes better than any severity score.

Popcorn Time began as a BitTorrent client with a Netflix-style interface. It became popular about a decade ago, before film-industry legal pressure shut it down, according to TechRadar. Because the code was open source, many forks followed. Time4Popcorn was one of them, distributed under the Popcorn Time name but with closed code, so outsiders had to reverse engineer it to see how it behaved.

The privilege level is what makes this serious. On Windows, the attack path ran code as NT AUTHORITY\SYSTEM, the account with near-total control over the machine. On macOS, the equivalent is root. An attacker who controlled the update channel could install whatever they wanted while the app ran with its own trust.

How the updater could be hijacked

The problem was not a single bug inside the video player. The updater contacted an abandoned domain over unencrypted HTTP and accepted unsigned executables. Anyone who controlled that domain could answer with a malicious file and have it run. CyberInsider reported that reverse engineering showed Windows clients would accept a JSON response pointing to an executable, download it and run it as NT AUTHORITY\SYSTEM.

Two design choices made the chain possible. Plain HTTP lets anyone on the network path read or alter traffic. Missing signature checks mean the client never verifies that a file came from the developer. Mozbot described this as a common weakness: updaters that download code without verifying signatures over unencrypted connections.

The abandoned domain made the situation worse. Nobody maintained it, so whoever registered it controlled what every installed copy would fetch. Eye Security registered it first, which turned a potential attack into a defensive opportunity.

Which versions are affected and how many machines

The affected builds appear in the table below. The CVSS score of 9.8 out of 10 comes from IT-Connect’s French-language write-up, and the reporting reviewed for this story did not include an independent confirmation of that score.

Eye Security observed up to 3 million Windows client connections and 350,000 macOS client connections to Time4Popcorn, according to BleepingComputer. Those connections came from residential ISPs and from corporate, government and military networks. That mix matters. A forgotten install could be sitting on a work laptop or a government desktop, not just a family PC.

The headline numbers are connection counts, not confirmed installs. CyberInsider reported that over six months the researchers counted more than 3.8 million distinct identifiers, but they could not reliably map those identifiers to individual devices. Nobody knows how many machines still run the app, and that number matters most for cleanup.

How Eye Security switched off the updater

Eye Security ran a campaign it called Operation IXIM between November 2025 and March 2026. During that period the team recorded more than 2 million update downloads. By March 1, requests to the update domain had dropped 98%, and at one point roughly 50 requests per second were hitting the registered domain.

The researchers registered the abandoned domain and 14 more related domains. They then pushed a remediation payload that disabled the updater remotely. Ownership of the domain later passed to The Shadowserver Foundation, a nonprofit security organization. The researchers say they were able to close the hole legally and keep devices safe, and they report that no threat actor appeared to exploit the flaw before the fix.

Eye compared its move to Operation Ladybird, the Dutch police operation that neutralized the Emotet botnet. The researchers also noted that users had installed this software voluntarily, a distinction that IT-Connect’s English coverage draws in its discussion of the case.

The remote fix is unusual. It worked because the updater trusted a domain that no one maintained, and the researchers were the ones who took it over. It did not uninstall anything. A machine that still has the app keeps the program on disk, and the fix only stops the updater from pulling new code. The sources also do not say whether someone else could re-register the domain after the handover to Shadowserver.

Whether Popcorn Time is safe to use now

Eye Security says its findings do not apply to a newer project launched under the Popcorn Time name in early 2025. That distinction matters, because the name alone does not tell you which code is running. If you installed something branded Popcorn Time and cannot tell which build it is, treat it as Time4Popcorn until you have checked.

Broader advice holds regardless of which fork you ran. Download software only from its maintainer, and be wary of any app that updates itself over a plain HTTP address. Abandoned projects deserve extra suspicion because nobody is watching their infrastructure.

How to remove Time4Popcorn on Windows, Mac and Android

Removal is the mitigation that works, since no fixed version exists. The steps below combine the research guidance with standard cleanup practice.

• Windows: Uninstall Time4Popcorn from Settings under Apps, and search for both “Popcorn Time” and “Time4Popcorn” in case two copies exist. Then check Task Manager for an Updater.exe process and look for leftover program folders and scheduled tasks. The researchers used the updater’s contact with popcorntimeupd.xyz as the tell, so that domain is a useful search term.
• macOS: Move the app from Applications to the Trash, empty the Trash, and check your user Library folders for leftover Popcorn Time files.
• Android: Remove the app manually from your device’s app list. Eye Security’s remote fix did not reach Android, and the affected Android build is 3.5.0.173.
• Work or government devices: Report any unknown torrent or streaming app to your IT or security team before removing it, so the team can check whether it appeared on other machines. This is general guidance rather than a finding from the research, but it matters here because connections came from corporate and government networks.

What comes next for abandoned software

Several questions remain open. The reporting reviewed for this story included no CISA advisory, no KEV listing and no FBI or FTC action, so this remains a consumer-security story for now. The device count is unresolved, Android exposure rests on a single source, and it is unclear whether anyone exploited the flaw before March 2026. Eye Security’s full write-up and a CVE.org or NVD record for CVE-2026-30612 would settle several of these points.

Android trust is under scrutiny elsewhere too. A Microsoft Authenticator flaw let Android apps steal work login tokens, a reminder that an installed app can reach data its user never meant to share.

The larger lesson concerns update pipelines. Consumer software often outlives the people who maintained it, and its update channel can outlive them too. Vendors that retire apps should take their update domains offline or hand them to a trusted party, and users should audit the software they forgot they installed.