Security researchers disabled abandoned Popcorn Time app to prevent botnet recruitment
Eye Security found millions of devices still running an updater for the defunct piracy app, leaving them vulnerable to hijacking, and took over the update mechanism to force the software to disable itself.
What happened
Researchers at Eye Security discovered that an updater for Time4Popcorn, a fork of the abandoned piracy streaming application, was still active on millions of Windows, macOS, and Android devices worldwide. The updater was communicating over unencrypted HTTP to defunct web domains and running an outdated, vulnerable version of Chrome. Eye Security registered one of the abandoned domains and sent out over 2 million updates by March that instructed the updater to disable itself—on Windows by stopping and disabling the service, and on macOS using a shell script to block the process from starting. Android devices were not addressed as they would have required manual user interaction. The researchers then transferred the domains to the Shadowserver Foundation.
Context
The abandoned updater represented a significant security risk because its update mechanism could have been compromised to install arbitrary software with full privileges on affected machines, enabling botnet creation, targeted man-in-the-middle attacks, or surveillance. The updater was no longer serving any functional purpose but was purely a vulnerability vector. By taking control of the update domains, the researchers were able to neutralize the threat without user awareness or action, though this approach raised ethical concerns about domain seizure. The scale of exposure—potentially millions of devices—underscores the ongoing risk posed by abandoned software with active but vulnerable update mechanisms.