Old Popcorn Time updater left up to 350,000 Macs open to hijacking, Eye Research says

A leftover update checker from an unofficial Popcorn Time app has been running on hundreds of thousands of Macs, and security researchers say it could have been hijacked to install malware. MacRumors reported the findings on October 29, based on research from the security firm Eye Research.

The software is Time4Popcorn, an unofficial fork distributed under the Popcorn Time name. According to Eye Research, its updater runs in the background on macOS as a launch daemon, so it starts with the Mac even if the user has not opened the app in years. It checks for updates over unencrypted HTTP and can download and run programs with root privileges on the Mac, the researchers say.

That design became dangerous once the project was abandoned. The web domains the updater contacts were expiring, and anyone who registered one could have sent the updater a malicious file to run. Eye Research says it found no evidence that attackers did this.

Eye Research first counted about 3.8 million hardware IDs over roughly six months, then revised the figures after finding the counts were unreliable. Its current estimate is about 2.5 to 3 million Windows hosts and 250,000 to 350,000 Macs.

The researchers took matters into their own hands. They registered abandoned domains the updater relied on and, between November 2025 and March 2026, pushed an update that disabled the updater service on Windows and the launch daemon on macOS. Eye Research says that reached more than one million systems by December 2025, and requests to its servers fell about 98 percent by March 1, 2026. In late March, it handed 15 domains to the nonprofit Shadowserver Foundation, which sinkholes malicious infrastructure. Some domains remain in third-party hands.

The fix is incomplete. It does not address other vulnerabilities in Time4Popcorn, and Eye Research warns that the main app is itself unsafe: it uses a 2014-era browser engine with the sandbox disabled and loads JavaScript over HTTP from abandoned domains. The issue is tracked as CVE-2026-30612, with an advisory published in June 2026, and the research was presented at hack.lu on October 22.

The researchers' advice is simple: anyone who still has Popcorn Time installed should uninstall it. Neither MacRumors nor Eye Research's report mentions any response from Apple.