Researchers at Eye Security have identified a security vulnerability affecting millions of devices that still run abandoned versions of Popcorn Time, a former torrenting application. Although development of the software ceased years ago, the program remains installed on Windows, macOS, and Android systems worldwide, creating a potential entry point for cyberattacks.
The threat stems from an updater associated with a Popcorn Time fork named Time4Popcorn. This component continues to operate on user devices, sending data to web domains that are no longer maintained. The communication occurs over unencrypted HTTP connections, leaving the data exposed. Additionally, the software relies on an outdated and insecure version of the Chrome browser engine.
Niels Teus of Eye Security noted that these dormant devices effectively form a "zombie army" waiting to be compromised. Because the original developers have abandoned the project, no patches or updates are available to fix these security flaws. The persistence of this software on millions of devices highlights the long-term risks associated with abandoned digital tools that continue to connect to the internet without active maintenance.