Tech

Abandoned Popcorn Time apps had to be disabled to prevent a zombie army

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 23/10/2026, 20:01:25 UTC.

Briefings

Eye Security researchers identified abandoned Popcorn Time applications still running on millions of devices, specifically the Time4Popcorn fork, which were phoning home to dead web domains via unencrypted HTTP connections. The evidence indicates these devices were running outdated, insecure versions of Chrome, creating a potential vulnerability for a bot army. The study was conducted by Niels Teus and published in October 2026, with findings based on a snapshot of the global device landscape at that time.

Key points

• Popcorn Time applications, including the Time4Popcorn fork, remain installed on millions of devices worldwide despite years of abandonment.
• These devices are actively communicating with now-deleted web domains over unencrypted HTTP connections using outdated, insecure Chrome versions.

Context

Popcorn Time was originally developed in the 2010s as a torrent streaming front end, but its development has been abandoned for years. The current evidence focuses on the Time4Popcorn fork, which continues to operate on a global scale, posing a security risk due to its reliance on unencrypted communication channels.

Limitations

The evidence is limited to a snapshot of the global device landscape as of October 2026, capturing only the state of the world at that specific time. It does not account for future updates, user actions, or the eventual removal of the Time4Popcorn fork from the market.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 23/10/2026, 20:02:32 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeienuu3qp4r5hmfknorglz3b34ktqyto5yelatnmystnwzrqmhlxcq