Popcorn Time, a popular software suite used for streaming pirated movies and television shows during the 2010s, has been officially abandoned by its developers for several years. Despite this, researchers at Eye Security have identified that millions of devices running a specific fork of the software, known as 'Time4Popcorn,' remain active and pose a significant security risk to their users.

The primary danger stems from the app's update mechanism. The software continues to 'phone home' to web domains that are no longer maintained. Because these connections occur over unencrypted HTTP and rely on outdated, insecure code, the infrastructure is susceptible to takeover by malicious actors. If a third party gains control of these abandoned domains, they could potentially push malicious updates to the millions of devices still running the software, effectively turning them into a 'zombie army' or botnet used for cyberattacks.

While the original Popcorn Time software was frequently targeted by the Motion Picture Association (MPAA) for facilitating copyright infringement, the current concern is focused on cybersecurity rather than piracy. The researchers emphasize that the risk is not just that the app is obsolete, but that it remains an active, unpatched gateway on personal computers and mobile devices worldwide. Users who still have these legacy versions installed are advised to remove them immediately to prevent their hardware from being co-opted for illicit network activity.