Dutch Researchers Quietly Pushed 2 Million Updates to Kill an Old Piracy App's Updater

Key points

• Between November 2025 and March 2026, Dutch firm Eye Security pushed more than 2 million silent updates to machines still running the Time4Popcorn updater, switching it off before criminals could take it over.
• Time4Popcorn is an abandoned fork of Popcorn Time, a free app from the mid-2010s that streamed pirated films over BitTorrent.
• The updater kept phoning home to a domain the original developers had let expire, which anyone could buy and use to push malware to every surviving install.
• Eye Security bought the domain and used the updater's own trust in it to deliver a kill switch instead of a payload.

Somewhere between two and three million computers around the world were still, as of late 2025, politely asking a dead piracy app for an update every time they booted.

The app was Time4Popcorn, a knock-off of Popcorn Time. Popcorn Time was a free program from around 2014 that let people watch pirated films and TV shows through BitTorrent, the file-sharing network. The original project shut down. Clones carried on, then those clones were abandoned too.

What nobody switched off was the updater. It's the small background program that checks whether a new version of the app is available and installs it. It had been sitting on all those machines for roughly a decade, calling home to a web address its original owners had stopped paying for.

That's the dangerous bit. If a domain expires, anyone can buy it. Whoever owns it can answer the update check with whatever file they like, and the updater, trusting its own maker, will install it with full permissions. The recipe for a botnet: a network of hijacked computers that criminals rent out to send spam, knock websites offline or mine cryptocurrency.

Who actually fixed this?

A Dutch cybersecurity firm called Eye Security. They bought the expired domain themselves, watched the incoming traffic to work out how many machines were still phoning in, then used the same trusted channel to push a tiny patch that disables the updater on the host machine. The campaign ran from November 2025 to March 2026. By their count, more than 2 million updates were delivered. The work was first reported by The Hacker News.

This isn't a new idea. Security researchers have done the same with other dead software, and law enforcement has done it to live botnets with court approval. We covered a four-country operation that used a botnet's own peer-to-peer design against it on 2 September 2026. The legal position is still awkward almost everywhere: you're modifying a computer you don't own, even if the modification is protective.

Should ordinary users do anything?

Probably not, but check your old laptop. If someone in the house installed Popcorn Time or Time4Popcorn years ago, the main app may be long gone from the Start menu while the background updater quietly runs on. On Windows, open Task Manager and click the Startup tab, looking for anything with "Popcorn" or "Time4" in the name. Macs: check System Settings, then General, then Login Items. Remove what you find.

The wider lesson is uglier. Abandoned software doesn't vanish when the website goes dark. It keeps reaching out, keeps trusting whoever answers.

The failure mode here isn't the pirated app itself. It's the ten-year-old updater that nobody retired. Audit your startup items, not just your installed programs.