Popcorn Time, once famed for turning torrent streams into a Netflix‑style experience, has not seen official development for years. Despite being effectively dead, the software – and a popular fork known as Time4Popcorn – remains installed on millions of Windows, macOS and Android devices worldwide.
A team at Eye Security discovered that the Time4Popcorn updater continues to run on a large number of machines. The updater contacts legacy web domains that are no longer maintained, does so over unencrypted HTTP, and relies on an outdated, vulnerable version of Chrome.
Because the updater can still receive commands, the researchers say the dormant installations could be recruited into a botnet, turning ordinary computers into a “zombie army” for malicious actors. Niels Teus of Eye Security warned that the combination of abandoned code, insecure communication and obsolete browser components creates a perfect storm for exploitation.
The findings highlight a broader issue: software that is no longer supported can linger on users’ devices, exposing them to risks long after the original project has been abandoned. Users who still have Popcorn Time or the Time4Popcorn fork installed are advised to remove it promptly to avoid becoming part of an unintended bot network.