Abandoned Popcorn Time fork's updater put millions of devices at risk of takeover

SecurityWeek reports Time4Popcorn, a Popcorn Time fork, ran an updater at boot that could execute code from its domains with full privileges. Eye Security observed millions of systems connecting to an abandoned domain and served a disabling update to roughly 2 million Windows and macOS systems by March 2026, but not Android. MacRumors says researchers found no evidence criminals installed malware this way; they recommend uninstalling the app because other vulnerabilities remain.