Dutch security firm Eye Security discovered that an abandoned version of the piracy app Popcorn Time contained a background updater (Updater.exe) that silently installed software with the highest system privileges over an unencrypted connection, leaving an estimated 2.5–3 million Windows computers and hundreds of thousands of Macs vulnerable to potential botnet takeover. After registering the expired web addresses the updater was calling, Eye Security used the updater's own mechanism to push a disabling update to over 2 million machines between November 2025 and March 2026, reducing traffic by 98%. Users are advised to fully uninstall Popcorn Time, as the app itself remains dangerous due to its outdated browser engine, disabled security sandbox, and connections to other abandoned addresses.
