An abandoned Popcorn Time updater left up to 350,000 Macs vulnerable to remote takeover, giving potential attackers a way to execute malicious code with full system privileges.
Security researchers at Eye Research detailed the discovery in an October 22, 2026, research report about Operation IXIM. The vulnerability affected Time4Popcorn, an abandoned fork of the popular BitTorrent streaming application that continued circulating under the Popcorn Time name after the original project shut down in 2014.
Some users had stopped using Popcorn Time, but its updater kept running. Eye Research discovered attackers could hijack it to install malware and intervened between November 2025 and March 2026.
How a forgotten updater exposed hundreds of thousands of Macs
The investigation began when Eye Research discovered an updater contacting an abandoned domain from a customer's Windows computer. Researchers registered the domain and found that approximately 50 requests were arriving every second from devices still running the software.
On macOS, the vulnerable component was a privileged helper called PT.updd, which launched automatically when the computer started. Like other macOS background services, the updater could run independently of the application itself, even when its owner wasn't actively using Popcorn Time.
The updater contacted its servers over unencrypted HTTP connections and accepted downloaded code without verifying its digital signature. On Macs, that code ran with root privileges, giving an attacker the ability to execute commands with the highest level of system access.
Anyone controlling one of the abandoned update domains, or capable of manipulating the network traffic, could potentially exploit the mechanism. The vulnerability was assigned CVE-2026-30612, although Eye Research didn't establish that criminals had already exploited it.
"We mapped a sample of the IP addresses using kepler.gl and they were everywhere." Image credit: Eye ResearchDetermining how many Macs were affected proved difficult. Researchers initially recorded approximately 1.7 million unique Mac identifiers, but later discovered that changes to a computer's hostname or network hardware addresses could cause the same machine to appear multiple times.
Eye Research revised its estimate to between 250,000 and 350,000 Macs. The company also estimated that approximately 2.5 million to 3 million Windows PCs had contacted the affected update infrastructure, although those figures aren't a verified count of individual devices.
Researchers used the vulnerability to disable the updater
With the original developers gone and no official patch available, Eye Research decided to use the vulnerable update mechanism to protect affected computers. The researchers developed a small update that disabled the background service responsible for checking for new software.
On Macs, the update ran a shell command that stopped the launch daemon responsible for starting PT.updd. The intervention didn't remove the application itself, and Eye Research said its repair was designed to leave other software and files untouched.
The approach raised legal and ethical questions because researchers were executing code on computers without their owners' explicit permission. Eye Research said it consulted its legal team and conducted extensive testing before deploying the update more widely.
The operation also encountered an unexpected obstacle involving antivirus software. On Windows, 11 security vendors initially detected the repair tool as malicious because it disabled an existing service, prompting researchers to modify their code to avoid those detections.
By December 2025, Eye Research reported deploying the update to more than a million systems. The campaign ultimately distributed more than 2 million update downloads, although that figure doesn't necessarily represent 2 million unique computers or confirmed successful repairs.
By March 1, 2026, the company was still delivering approximately 5,000 updates daily, representing a reported 98% decrease from earlier volumes. Eye Research subsequently ended the deployment and transferred 15 domains it controlled to the nonprofit Shadowserver Foundation in late March.
"A bit of debugging led us to this snippet of the code that was generating the hid." Image credit: Eye ResearchThe researchers couldn't obtain every domain associated with the abandoned software, leaving some update infrastructure outside their control. Their intervention substantially reduced the apparent exposure, but it doesn't guarantee that every vulnerable Mac received the repair.
Disabling the updater doesn't make Popcorn Time safe
Eye Research also discovered serious vulnerabilities in the main application that weren't addressed by the emergency update. The affected Time4Popcorn software uses a browser engine dating to 2014, with its security sandbox disabled.
The app loads JavaScript over unencrypted connections from domains its original developers no longer maintain. Researchers showed that malicious JavaScript could run programs on Windows, but they didn't demonstrate the same attack on macOS.
Disabling the vulnerable updater addressed only one security risk. The outdated Popcorn Time application could still expose users to malicious content and attacks that manipulate network traffic.
Abandoned software can remain a security risk long after developers stop supporting it. Even when nobody opens the application, privileged background processes can keep running without security updates.
How to remove Popcorn Time and protect your Mac
Mac users who installed the Time4Popcorn version of Popcorn Time should remove it, even if they haven't opened the app in years. Eye Research recommends a complete uninstall because disabling the updater doesn't fix the app's other security vulnerabilities.
Deleting apps from the Applications folder doesn't necessarily remove associated background services. Users can check for the vulnerable Mac updater by opening Finder, selecting Go > Go to Folder, and entering /Library/PrivilegedHelperTools/ to look for a file named PT.updd.
The associated launch daemon is located at /Library/LaunchDaemons/PT.updd.plist. Eye Research's security advisory provides the specific Terminal command needed to disable the service if it's still present.
Mac owners should also keep macOS updated and maintain Apple's built-in malware protections. However, operating system security updates won't correct vulnerabilities in an abandoned third-party application.
The findings specifically concern the older Time4Popcorn fork and don't apply to a separate project that began using the Popcorn Time name in 2025.