This Forgotten Movie App May Be Hiding a Security Risk on Your Mac

A recently reported botnet threat highlights the importance of cleaning up your Mac by getting rid of old apps you’re no longer using — even those that are no longer being regularly updated. Or maybe especially those, in this case.

Last week, the researchers at Eye Security shared more details on CVE-2026-30612, a vulnerability they reported on in June in Time4Popcorn, a fork of the once-popular Popcorn Time app — and the somewhat controversial step they took to fix it.

This Limited-Time Microsoft Office Deal Gets You Lifetime Access for Just $39

Sick and tired of subscriptions? Get a lifetime license for Microsoft Office Home and Business 2021 at a great price!

For those unfamiliar with the app, Popcorn Time was a media player with a BitTorrent client behind it, allowing users to watch free movies from various torrent sites by sequentially downloading and streaming the videos. The original Popcorn Time was taken down in 2014, but there have been more than a few forks of the app, including Time4Popcorn, which infamously became available even on jailbroken iPhones.

How a Forgotten Updater Left the Door Wide Open

While Time4Popcorn was abandoned years ago, many users who had installed the app hadn’t bothered to uninstall it; they’d just stopped using it. However, while the app itself remained inert, like many macOS apps, Time4Popcorn came with an updater that continued running in the background to check for new versions.

That was easy for most users to miss after updates stopped coming, but it also left a gaping hole for hackers to exploit. The updater wasn’t designed to check for signatures on new versions — it implicitly trusted anything fed to it — and it had enough privileges to change pretty much anything on the Mac (a macOS daemon that ran with full root privileges over unencrypted HTTP).

Nearly all software updaters work by checking an online server for updates, and they’re coded to do so using a specific hostname. For active developers, that’s a non-issue; nobody but Apple is going to be able to grab anything ending in “apple.com,” for example, so when macOS checks for updates, it will always be going to a legitimate destination.

But for abandonware like Time4Popcorn, it’s highly unlikely the developers are going to keep paying to renew the domain name. When that eventually lapses, anyone on the internet can pick it up just by paying the standard domain registration fee, which can be as little as $20. A software updater running on your Mac will keep phoning home to that hardcoded domain name, entirely unaware that it’s no longer under the original developer’s control.

To be clear, many software updaters are designed with additional checks and balances. Even in the highly unlikely event that somebody could hijack a domain name for something like Apple’s macOS updates, there are cryptographic signatures and encryption checks involved that would make your Mac refuse to talk to an unauthorized server. There’s every reason to believe that Time4Popcorn was being more than a bit sloppy here by blindly trusting everything it found at the other end of that pipe, but, to be fair, this was also a grassroots fork.

Hacking Millions of Macs to Save Them

Thankfully, the good guys found this particular vulnerability first. Eye Security discovered the problem last year, and before they even published the CVE, they kicked off “Operation IXIM,” using the very vulnerability they’d discovered to effectively close the hole.

Essentially, the goal of Operation IXIM was to use the Time4Popcorn updater to push out an update disabling the updater. The process doesn’t actually uninstall anything or touch any other files — it merely shuts down the process that runs in the background.

This was deemed harmless as the original developers of Time4Popcorn have effectively vanished, and there are no official patches available. Still, it raises some ethical concerns, as the researchers were technically “hacking” other people’s computers — running code on them without their explicit consent.

At the end of the day, the abandoned update process was an entirely useless piece of cruft on the computers where it was running, and in addition to consuming resources, it was leaving users exposed to the risk that someone less ethical than Eye Security might come along and drop their own bomb down the open chute.

As the researchers noted, even though users who had the Popcorn Time fork on their computers almost certainly installed it deliberately, “none of them chose to have a forgotten updater running in the background for years, ready to run any code with full privileges for whoever controlled one of its domains.”

The researchers ran extensive tests of the update before deploying it in the wild just to make sure they wouldn’t inadvertently break anything.

When they first configured their own servers with the updater domain, researchers quickly discovered there were millions of Windows PCs and Macs running the Time4Popcorn updater simply by looking at the server logs to watch the requests coming in. This also allowed them to measure how many computers they were able to “fix” simply by watching the requests drop.

By December 2025, after deploying their patch to more than a million systems, they’d observed a 90% reduction in update requests. Of those systems affected, roughly 250,000 to 350,000 were Macs, while 2.5 to 3 million were Windows PCs.

By March 1, 2026, they were sending out around 5,000 updates per day, representing a 98% reduction. At that point, they decided their work was done, as the attack profile had been reduced below the threshold where it would be worth a botnet operator’s time to exploit it. The researchers transferred the 15 domains they’d purchased to The Shadowserver Foundation for safekeeping.

However, the researchers note that they weren’t able to purchase all of the domains used by Time4Popcorn, as some had already been registered by third parties. There’s no indication those were bought for nefarious purposes, but it may leave the door open to other potential attack vectors.

Even with the updater disabled, it’s likely a bad idea to keep the Time4Popcorn fork of Popcorn Time around, since the app hasn’t been updated in years. The researchers note that it’s built on a Chrome engine from 2014 — with the sandbox disabled. With the number of security vulnerabilities found in Chrome over the years, that means it likely has more holes than a fishing net, and it also runs JavaScript from other abandoned domains.

How to Completely Remove Popcorn Time From Your Mac

The bottom line is that if you have any old flavor of Popcorn Time installed on your Mac (or Windows PC), you should uninstall it immediately. If it’s been lying around in your Applications folder, it’s just taking up needless space, but even if you’re still using it, it’s long past time to move on.

Deleting the app from the Applications folder won’t necessarily nuke the updater and other background services unless you have another cleanup tool running. The best way to make sure this is gone for good is to ensure you’ve cleaned up all the hidden pieces:

1. Open Finder and go to your Applications folder.
2. Locate Popcorn Time and drag it to your Trash.
3. From the Finder menu, select Go > Go to Folder.
4. Type “/Library/PrivilegedHelperTools/“ and press Return to open that folder.
5. If you see a file named PT.updd there, drag it to your Trash. Authenticate with Touch ID or your password when prompted.
6. Select Go > Go to Folder again.
7. Type “/Library/LaunchDaemons/“ and press Return.
8. Drag PT.updd.plist to your Trash. Authenticate with Touch ID or your password when prompted.
9. Reboot your Mac.
   

Note that there’s a modern, unrelated version of Popcorn Time that’s being built as a legal alternative, simply aggregating content from platforms the user is already paying for. This is a web-based service, not a Mac app, and the researchers note it has nothing to do with the legacy versions being discussed here.