An abandoned movie app nearly gave hackers millions of computers
In short: Old versions of Time4Popcorn, a copy of the Popcorn Time film-streaming app, kept checking an abandoned website for updates over an insecure connection and would install anything it was given. Researchers at Eye Security registered the website and used it to switch the updater off on about two million computers. Android users are still at risk, and the safest step is to uninstall the app.
What happened
Popcorn Time was a popular app for streaming films over BitTorrent. Its official project shut down years ago, but copies and "forks" lived on. One of them, Time4Popcorn, has an automatic updater for Windows and macOS that kept contacting a website its developers had abandoned.
Researchers at Eye Security discovered that the updater had two serious weaknesses, now tracked as CVE-2026-30612:
- it checked for updates over plain, unencrypted HTTP, so the traffic could be changed on the way;
- it installed whatever program it received without checking a digital signature, the proof that software really comes from its maker.
Anyone who registered that forgotten web address could therefore have sent a fake "update" and taken full control of every computer still running the app, with the highest level of access (SYSTEM on Windows, root on macOS).
How the researchers stopped it
Eye Security registered the domain first, then 14 more linked to the service. They saw connections from up to 3 million Windows and 350,000 Mac computers, most of them apparently no longer used to watch anything. Between November 2025 and March 2026 they used the updater one last time to deliver a small fix that stopped and disabled the updater, without collecting data or deleting files. It was downloaded about 2 million times, and by March requests had dropped by 98%. The domains have now been handed to the non-profit Shadowserver Foundation.
Why it matters
This is a near miss, not an attack, but it shows a risk most people never think about. Abandoned software keeps running, and an updater is a direct line into your computer. If the people who control the update website change, that line can be used by someone else. The app also still uses a 2014 version of the Chrome engine without modern protections, and Android copies could not be fixed remotely.
What it means for you
Software that is no longer maintained gets no security fixes, so remove it. That matters as much as keeping your devices updated. Also be wary of free film and TV apps from unofficial sources: they are a common way for malware to arrive, as our guide to spotting scam messages and our note on phishing explain.
Quick checklist
- Uninstall Popcorn Time, Time4Popcorn or any similar app on your computer and phone.
- Look through your installed apps and remove anything you no longer use or do not recognise.
- Install apps only from official stores or the maker's own website.
- Run a full scan with your security software.
Key takeaways
- Old copies of Time4Popcorn checked an abandoned website for updates over plain HTTP and ran anything they received.
- Whoever controlled that website could have taken over millions of Windows and Mac computers.
- Eye Security registered the domains and switched the updater off on about 2 million computers.
- Uninstall the app, including on Android, and remove any software you no longer use.
Understand the basics
New to this topic? These short FM TecHub guides explain the ideas behind this story.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.