Popcorn Time Botnet Risk: 3.8M Devices and a Benign Fix

A Popcorn Time botnet never happened, but it came close. Security researchers found that millions of PCs and Macs still ran an abandoned updater that would obey anyone who owned its lapsed web domains.

Eye Security registered those domains first and used them to switch the updater off. They presented the full story at hack.lu on 22 October 2026, and The Verge covered it.

Key takeaways

• The vulnerable app is Time4Popcorn, a closed-source fork of Popcorn Time. The original project was shut down in 2014.
• Its updater fetched code over plain HTTP and ran it with top-level privileges, with no signature check. The flaw is tracked as CVE-2026-30612.
• Eye Security saw over 3.8 million hardware IDs in six months. It estimates 2.5 to 3.0 million Windows hosts and 250,000 to 350,000 Macs.
• The team pushed a benign update that only disabled the updater. The app itself is still unsafe, so uninstall it.

What is the Popcorn Time botnet risk?

Popcorn Time was a friendly front end for streaming torrents, nicknamed the "Netflix of piracy". Many forks appeared after the original died. One of them, Time4Popcorn, installed a background updater that never stopped running, even after its developers vanished.

That updater kept calling domains that nobody paid for anymore. A domain left to expire is like an unlocked mailbox with a sign saying "send instructions here". Whoever registers it gets to talk to every device still listening.

How did the flaw work?

Eye Security’s researchers noticed the updater during a routine threat hunt, when a client laptop tried to reach an unregistered domain. According to their Operation IXIM write-up, the updater asked for a JSON reply over unencrypted HTTP, downloaded the executable it pointed to, and ran it. On Windows that meant SYSTEM rights, and on macOS it meant root.

Nothing checked who signed the file. Anyone controlling a domain, or sitting on the network path, could have delivered ransomware, a spy tool or a botnet client. That is the CWE-494 weakness class: download of code without an integrity check.

How big was the exposure?

After registering a domain, the team saw about 50 requests per second. Clients appeared on home ISPs and on corporate, government and military networks.

The team admits the counts are rough. Hardware IDs were unreliable: cloned laptop images shared IDs, and a Mac’s ID changed when its hostname did. They revised the macOS estimate down from about 1.7 million.

What did the researchers actually do?

Between November 2025 and March 2026, Eye registered 15 lapsed domains and served a benign update. It stopped and disabled the Windows "Update service" and unloaded the macOS launch daemon. By their account it collected no telemetry and deleted no files.

Safeguards included serving only previously seen IDs and one update per ID. In late March 2026 they handed all 15 domains to The Shadowserver Foundation, a nonprofit that sinkholes malicious traffic. A summary by Safeguard notes the CVE advisory came out on 11 June 2026.

Was it controversial?

Yes. Pushing code to strangers’ machines without consent is exactly what an attacker would do, even with good intent. Eleven VirusTotal vendors flagged the update as malicious, and the team tweaked it until only one did.

My view, clearly opinion: the choice was ugly but defensible. The alternative was leaving a loaded door open for whoever grabbed the domains next. Still, it is a one-off, not a template.

What happens next?

Several questions remain open. Five of the 20 published domains sit with third parties, and Eye did not say who. Nobody reports a malicious update ever being served, but the team only saw traffic after it registered its own domains.

Android was never fixed. The app there checks for updates on launch and asks before installing, so Eye deployed nothing. There is no patch for the CVE, and the app still runs a 2014-era browser engine with its sandbox disabled and loads scripts over HTTP.

It echoes themes we covered in Armin Ronacher’s warning on bad software: old code outlives its authors and eventually someone pays for it. For another case of attackers abusing trusted-looking flows, see our piece on the ROMULUS ClickFix platform.

FAQ

Is my computer at risk if I once installed Popcorn Time?

Only if a Time4Popcorn-style fork is still installed. Check for a service called "Update service" with Updater.exe on Windows, or PT.updd on macOS, and treat machines that contacted non-Eye domains as potentially compromised.

Does the disabling update make the app safe?

No. It only stops the updater. The app itself still loads content over HTTP and uses an outdated, unsandboxed browser engine, and the researchers built a proof of concept that runs calc.exe. Uninstall it.

Did anyone actually build the botnet?

No malicious update has been reported. The risk was real, but the evidence of abuse is absent, and that cannot be fully ruled out.

Next step: open your installed apps list, remove any old torrent streaming client, and read Eye’s indicator list if you run a security team.