Remember streaming TV and films with Popcorn Time? Maybe not. A forgotten Popcorn Time updater could potentially let attackers hijack up to an estimated 350,000 Macs. As it turns out, it kept running in the background even after people stopped using the entertainment app.
The flaw allowed anyone who controlled an expired update domain to run code on affected Macs without root access. Researchers have disabled the updater on many machines since then, but the app itself remains risky. Uninstall it if you haven’t already.
How the Popcorn Time updater put Macs at risk
Popcorn Time is a free, open-source streaming application that lets users watch movies and TV shows without downloading entire video files first. It uses BitTorrent peer-to-peer technology to stream content from other users while displaying a Netflix-like library of titles. The original project shut down in 2014, but various independent forks continued using the Popcorn Time name.
And the fact that it’s been around for so long, and is partially shut down, made the app’s updater a problem, according to a security report.
Dutch security firm Eye Security shared the findings in a report titled Operation IXIM. They also presented the research at the hack.lu conference in Luxembourg.
The updater in question belongs to Time4Popcorn, one of the closed-source forks of Popcorn Time. There are many, making it hard for users to tell which version they had.
Eye Security found the updater during a routine threat hunt. The process was spotted on a client’s laptop because it was trying to reach a domain nobody had registered. The firm published an advisory in June, and the flaw is tracked as CVE-2026-30612.
The update checked for new versions of the app over unencrypted HTTP, with Eye Security saying it never verified code signatures. That means it would download whatever it was given and run it with high privileges. On Macs, that translated to root access.
The updater also runs automatically at startup, meaning a Mac could stay exposed even if the suer had not opened Popcorn Time in years.
How many Macs are affected?
After Eye Security registered the abandoned Popcorn Time domain, it saw around 50 requests per second. In just six months, it saw more than 3.8 million unique device IDs, with roughly 45% coming from Macs.
But those IDs turned out to be unreliable. On Macs, they depend partly on the hostname, which can change. This means the Mac count is most likely inflated. Its first estimate was about 1.7 million Macs, but the best guess is now 250,000 to 350,000.
In a sample of IP addresses, most clients connected from home internet providers, but Eye Security also spotted government, military and corporate networks.
To be clear, Eye Security didn’t discover any attacks that actually used the flaw. It’s just a potential problem.
Researchers used the flaw to switch it off
The software was abandoned long ago, so there was no vendor to issue a patch. The firm considered buying every update domain, but some of them are held by third parties. The unencrypted connection also meant some users were left open to anyone tampering with their network traffic.
Eye Security took legal advice and decided to push its own update. It used the flawed mechanism to deliver code to turn the updater off.
On Macs, it unloaded the launch daemon behind the updater, while the Windows version collected no telemetry and deleted no files.
The rollout started in November 2025, and by December, it reached more than 1 million systems. By March 2026, requests to its domains were down by 98%.
Eye Security stopped after sending more than 2 million update downloads. In March, it transferred the 15 domains it purchased to the Shadowserver Foundation. However, some domains remain with third parties, so machines that contact those might still be exposed.
Why Mac users should still uninstall Popcorn Time
Disabling the updater doesn’t make the app safe. Eye Security says the app runs on a Chrome engine from 2014 with sandbox disabled. It also loads JavaScript over unencrypted HTTP from abandoned domains.
The firm had registered those domains so it would run its own code inside the app. Eventually, it didn’t and handed them to Shadowserver as well.
Eye Security’s advice is pretty straightforward: uninstall Popcorn Time. It lists the usual Mac location of the updater as Library/PrivilegedHelperTools/PT.updd. If you find that file, Time4Popcorn was installed.
The firm didn’t push its fix to Android. A separate project using the name Popcorn Time since early 2025 isn’t affected.
If you installed a Popcorn Time fork years ago, now is a good time to check and remove it.
Anurag Chawake is a tech-focused writer specializing in smartphones, apps and consumer technology. His interest in computers began during the Windows 98 era, eventually leading him to explore everything from operating systems to mobile devices and PC hardware. Anurag previously contributed to The Indian Express, covering Apple, Android, gaming and the broader technology landscape.
