They found a way to insert malicious code into subtitle files used by popular media players, including VLC, Kodi, Popcorn Time and Stremio. As soon as the player parses those evil files before displaying the actual subtitles on the screen, the attacker is granted control of the computers and TVs on which they ran, Check Point said. And, as such subtitles are typically downloaded automatically from online repositories that can be gamed, hackers can easily force media players to download their malicious subtitles rather than legitimate ones, the researchers discovered.