Millions of Devices Still Run Abandoned Popcorn Time App

Millions of devices worldwide are still running an abandoned Popcorn Time fork that security researchers say could have been hijacked into a botnet, according to The Verge.

The app, a Popcorn Time variant called Time4Popcorn, once let users stream pirated movies and TV shows through a torrent-based front end. Development on the original software stopped years ago, but Time4Popcorn's background updater kept running on machines long after the project went dark, The Verge reported.

What is Time4Popcorn and why did it get disabled?

Researchers at Eye Security identified Time4Popcorn's updater still active on Windows, macOS, and Android devices around the world, The Verge reported. The updater was phoning home to web domains that had themselves been abandoned, using unencrypted HTTP connections, and bundling an outdated, insecure version of Chrome, according to the outlet.

How many devices were affected?

The Verge, citing Eye Security's findings, said the software was still installed on millions of devices. Those machines had no active developer maintaining the app, yet the updater kept checking in automatically, creating a standing network of software with no one minding it.

What could an attacker have done with it?

Eye Security researcher Niels Teusink said the updater could have been used to install and run almost any kind of software with full device privileges, The Verge reported. Teusink said that capability meant someone could build a botnet simply by taking control of one of the dormant domains the updater was still contacting. A hijacked domain could also be used to run a man-in-the-middle attack against specific devices or to conduct surveillance by identifying which machines were still running the outdated software, according to the report.

Because the updater ran with full privileges and reached out over unencrypted HTTP, any party who registered one of the abandoned domains could, in theory, push code to every connected device at once, The Verge reported — the scenario researchers flagged as the path to a mass botnet, or what the outlet's headline called a "zombie army."

Why does outdated software like this keep running unnoticed?

Popcorn Time's cat-and-mouse history with the Motion Picture Association made it a recurring target, and The Verge noted the service has been called the "Netflix of Piracy" in prior coverage of its refusal to die despite repeated shutdown efforts. That same resilience — forks and mirrors popping up after each takedown — is part of why remnants like Time4Popcorn's updater persisted on devices long after anyone was actively maintaining the underlying project.

What should users do now?

The Verge's report does not list specific removal steps beyond identifying the risk, but the underlying lesson is straightforward: software installed years ago and forgotten can keep running background processes with system-level access. Users who installed Popcorn Time or any of its forks in the past should check installed-program lists and background startup items for Time4Popcorn or similar names, and uninstall anything no longer in active use.

For the full technical findings, read The Verge's report on the Eye Security research.