Forgotten Streaming App Left Millions of Computers Exposed To Full Takeovers

Even if you immediately deleted that pirated app you downloaded to get your favorite movie, there may be a secret updater still running on your computer years later. It could download and run almost any executable file without proper security checks.

Eye Research, a Dutch cybersecurity firm, stumbled upon a piracy app that had left a hidden updater running on millions of computers. The updater could download and run an executable file from whoever controlled its update domains.^[1] This meant that anyone who took control of one of those domains could potentially install malware, ransomware, or spyware on millions of computers worldwide.

Here’s everything you need to know about the updater and what you can do to keep yourself safe.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How an abandoned streaming app left millions exposed

The piracy app dates back to 2014 and is called Popcorn Time, which lets people stream pirated movies. The original version was shut down that same year. However, several copycat versions emerged due to its popularity. The one in this story is a copycat version called Time4Popcorn.

While routinely scanning client computers for threats, Eye Research noticed a program called Updater.exe trying to contact a website that no longer existed. This turned out to be Popcorn Time’s updater. Nobody at the client organization was using Popcorn Time anymore. They had installed it years ago and probably forgotten about it, but the updater was still running quietly in the background, checking for updates from defunct websites.

To gauge the extent of these update requests, Eye Research registered one of the expired domains and was shocked to find about 50 requests per second. Over six months, devices sent roughly 3.8 million different ID codes from Windows PCs, Macs, and some Android phones. These ID numbers later proved to be unreliable. Eye Research’s final estimate was about 2.5 to 3 million Windows machines and 250,000 to 350,000 Macs.

To see what the updater would accept, the researchers reverse-engineered the program and found that it would download whatever executable file it was pointed to and run it with high privileges on both Windows and Mac machines. On Windows, it could execute code with SYSTEM privileges, while on macOS, it could run code as root.

It didn’t check whether an update was genuine, as there was no code signing or verification. All of this happened over unencrypted connections, so anyone able to tamper with your internet traffic, such as someone on public Wi-Fi or a hostile government, could potentially inject their own updates.

The update web addresses were scattered across several domains. Eye Research registered one, but others were held by domain resellers, and one hosted someone’s personal blog. Whoever controlled any of these domains could potentially have taken over every computer that sent update requests to it.

For ransomware gangs and other malicious parties, this was essentially a ready-made opportunity to compromise millions of machines, some of which were inside corporate establishments and even government and military networks.

How Eye Research fixed the updater

Normally, when a security firm finds such a flaw, it reports it to the software maker so it can be fixed. However, in this case, the makers were anonymous “pirates” who had long ago abandoned the software’s update domains and couldn’t push a fix even if they wanted to.

The other alternative was to buy every domain, but that wouldn’t work because some owners might refuse to sell. The unencrypted connections would still be vulnerable to tampering. The only other alternative was to do nothing.

So Eye Research decided to send the affected machines an update whose only job was to turn off the updater. This presented an ethical dilemma, which is why the firm consulted its lawyers. They compared the situation to Operation Ladybird, in which the Dutch police pushed an update to neutralize the Emotet botnet.

Eye Research’s fix simply stopped the updater service and disabled it on Windows and Mac. No data collection, file deletion, or anything else was involved.

However, someone uploaded Eye Research’s fix to VirusTotal, a service where antivirus companies scan files. Within a week, 11 security vendors flagged it as malware because, technically, it did exactly what malware can do: disable a service. This was a real problem because every blocked fix left a computer vulnerable to the updater.

Eye Research then modified its code to evade those detections until only one vendor was still flagging it. The fix rollout began in November 2025, and update requests dropped by 90% within a month. By December, more than one million systems had received the update. By March 2026, requests were down by 98%, with more than two million updates sent.

In late March, Eye Research transferred 15 domains it controlled to the Shadowserver Foundation, a nonprofit that “sinkholes” dangerous domains so they cannot be misused. In June, a public advisory was published, and the flaw was officially logged as CVE-2026-30612.

Eye Research didn’t push updates to Android devices because installing them required user approval, and the updater couldn’t be switched off separately from the app.

What could attackers have done with it

An updater like this hands over extensive control of your computer to a malicious party. Whoever controlled an update domain could silently install almost anything they wanted on millions of computers worldwide, without pop-ups, warnings, or clicks required.

• Ransomware: Eye Research noted that ransomware gangs often buy access to ready-made botnets to gain a foothold in computers. Since some of the affected machines were on corporate, government, and military networks, a single compromised laptop could have been the entry point for locking up an entire organization’s systems.
• Password and data theft: Attackers could have installed password-stealing malware to harvest credentials stored in browsers and applications.
• Identity theft: With full control of a machine, attackers could collect saved passwords, banking sessions, tax files, personal photos, scanned ID documents, and any other personally identifiable information saved on your system. This information could be used to open accounts in your name, take over existing ones, or impersonate you.
• Phishing: Stolen email and social media logins are valuable to scammers, allowing them to send personalized phishing messages that are far more convincing. A victim’s contacts could receive fake invoices, malicious links, or payment requests that appear to come from someone they know.

How to stay safe from the vulnerable Popcorn Time updater

Here are some ways to safeguard your devices from the vulnerable Time4Popcorn updater and its potential security risks.

1. Remove Time4Popcorn: Eye Research’s fix only switched off the updater. The app itself is still dangerous. It runs on a 2014-era browser engine without a security sandbox, uses unencrypted connections, and can load code from abandoned websites. So, if you still have it installed on your system, this is the time to uninstall it.
2. Check whether the updater is still there: Uninstalling the app doesn’t always remove its background components, as Eye Research found. Look for any remaining updater files. If they’re still present after uninstalling, remove them or use a reputable security tool to help identify and remove them.
3. Change your passwords: If you’ve ever installed Time4Popcorn or one of its copycat versions, it’s worth taking precautions, although Eye Research didn’t report evidence that attackers had exploited the updater. To be on the safe side, change the passwords for sensitive accounts and turn on two-factor authentication wherever possible. You can also use a reliable password manager to generate and remember strong passwords.
4. Remove unused applications: The incident also reminds us that apps can keep running long after you stop using them. Go to your list of installed programs and remove anything you don’t recognize or no longer use.

Also, consider getting an identity theft protection service that can help you look for your information on the dark web and in known breached databases in case your information has been exposed.

The bottom line

Eye Research found an updater that could contact websites looking for updates, and anyone who took control of those websites could potentially push ransomware, malware, spyware, and information-stealing tools onto millions of devices worldwide. The updater ran without proper security checks and used unencrypted connections.

Thankfully, Eye Research has now disabled the vulnerable updater on millions of systems. However, this incident reminds us that abandoned apps can keep running in the background on your computer for years, potentially putting your system at risk without you having to lift a finger.

Uninstall any old software you no longer use and check for leftover components. If you have used pirated streaming apps in the past, consider reviewing your account security and checking whether any sensitive information may have been exposed.

Protect Every Aspect of Your Digital Life — Even Your Time

4.7

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On TotalAV's website

2026 Editors’ Choice

Best Antivirus for Safe Browsing

Antivirus Software

TotalAV

PROMOTION: Get $80 Off

• Antivirus that earned AV-TEST's Top Product award on Windows in August 2026
• Passed every malware and drive-by download test we ran, quarantining threats automatically
• Includes a junk cleaner, app uninstaller, and browser cleaner to keep your device running smoothly alongside the antivirus

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news