conv.

All stories
SecurityQuiet 13d · day 13

Abandoned Popcorn Time app left 250K–350K Macs vulnerable to hijacking

Eye Research discovered an orphaned update checker that could have allowed attackers to install malware on affected machines.

newest coverage 12d agosummary written 13d ago7 pieces22 likes & upvotes2 comments NewswiresMastodonHacker NewsGoogle News

What to know

  • Time4Popcorn, an abandoned unofficial version of Popcorn Time, left an update checker running on 250,000–350,000 Macs that blindly executed any software it downloaded.
  • Expired domain names meant attackers could have redirected the checker to install malware, but Eye Research found no evidence this occurred.
  • Eye Research remotely disabled the checker on over 1 million machines and transferred control of the addresses to Shadowserver Foundation, but other vulnerabilities remain.
  • Users with the app should uninstall it immediately; it may not be recognizable since it was distributed under the Popcorn Time name.

Eye Research Security firm that discovered and disclosed vulnerabilityShadowserver Foundation Nonprofit cybersecurity organizationTime4Popcorn developers Original creators of unofficial Popcorn Time version

Abandoned Popcorn Time app left 250K–350K Macs vulnerable to hijacking
macrumors.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 5 pieces in 3h at Oct 29, 12 PM; 7 pieces over 13 days (3 articles · 4 posts) Oct 29, 12 PM — 5 pieces · 3 articles · 2 posts — Mastodon 2, Google News 1, Newswires 1, +1 moreOct 29, 3 PM — quietOct 29, 6 PM — 1 piece · 1 post — Mastodon 1Oct 29, 9 PM — quietOct 30, 12 AM — quietOct 30, 3 AM — quietOct 30, 6 AM — quietOct 30, 9 AM — 1 piece · 1 post — Hacker News 1Oct 30, 12 PM — quietOct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — quietNov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — quietNov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — quietNov 2, 5 PM — quietNov 2, 8 PM — quietNov 2, 11 PM — quietNov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — quietNov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quietToday, 5 AM — quietToday, 8 AM — quietToday, 11 AM — quietToday, 2 PM — quietToday, 5 PM — quietToday, 8 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:14 PM ET
  1. 1

    Researchers advise uninstalling Time4Popcorn despite remote fix, other vulnerabilities remain

    Eye Research noted that the remote fix does not address other vulnerabilities in Time4Popcorn and some updated addresses remain outside the researchers' control. Users are advised to uninstall the app. The confusion is heightened because Time4Popcorn was distributed under the Popcorn Time name, so users may not know if they have the affected version.

    “For that reason, if you're still running that version, the researchers' advice is simple: uninstall it.”
    — MacRumors / Eye Research
    1. 1 outlet Old 'Popcorn Time' App Left Hundreds of Thousands of Macs at Risk

      first by MacRumors, 13d ago

    • maxburn@noauthority.social

      Lovely, and I’m willing to bet transfer assistant was helpful enough to move that over to a new computer for you too. https://www. macrumors.com/2026/10/29/old-p opcorn-time-app-macs-at-risk/

      maxburn@noauthority.socialMastodon13d agoview on Mastodon ↗
  2. background

    Eye Research remotely disables checker on over 1 million machines, no active exploitation found — Eye Research took control of an abandoned address used by the update checker and estimates 250,000 to 350,000 Macs were affected. The researchers used the checker itself to disable it on more than a million Macs and Windows PCs, then handed the addresses to the Shadowserver Foundation. No evidence of active criminal exploitation was found.

  3. background

    Expired domain addresses created attack vector for malware installation — Because Time4Popcorn's developers abandoned the project, the website addresses the update checker contacted were expiring. This meant anyone taking over those addresses could use them to install harmful software on affected machines.

  4. background

    Eye Research discloses Time4Popcorn vulnerability affecting hundreds of thousands of Macs — Security firm Eye Research detailed a vulnerability in Time4Popcorn, an unofficial version of Popcorn Time, where an abandoned update checker continued running on affected systems, scanning for updates at every startup and trusting whatever it downloaded with full system permissions.