Security researchers have uncovered a serious vulnerability impacting a version of the discontinued streaming app Popcorn Time. The build in question, Time4Popcorn—an unofficial release—left Macs running a rogue update checker that activates at startup. Even if the main app hasn’t been opened in years, this updater still searches for updates and grants any downloaded content full access to modify the system. With the original developers gone, domain names tied to the updater have lapsed, opening the door for malicious takeover. Fortunately, no evidence of bad actors exploiting the vulnerability has emerged so far.
The issue came to light after cybersecurity firm Eye Research analyzed the Time4Popcorn updater’s behavior. The updater scanned for updates against specific web addresses every time macOS booted, trusting whatever came through without verifying authenticity. Because the app source was abandoned, the domains could expire and be registered by attackers, who could then send rogue updates with full system permissions. Eye Research estimated that between 250,000 and 350,000 Macs were still affected. Across both Mac and Windows machines, researchers disabled the updater process on over a million devices. They then transferred control of the abandoned domains to nonprofit security group Shadowserver Foundation to prevent misuse.
Despite this mitigation, Eye Research emphasized that the damage isn’t fully neutralized. Several update addresses remain outside the reach of the firm’s control, and other vulnerabilities in Time4Popcorn persist. For most users, the safest course is to completely uninstall the app. Because Time4Popcorn masqueraded under the Popcorn Time name, many people might not realize which version they installed—making it hard to know whether they’re at risk.
Why This Matters
The Popcorn Time ecosystem comprises various community-driven and unofficial clones of what was once a popular media streaming app. Time4Popcorn was one of these unofficial variants, not maintained by the original creators. The risk here is systemic: auto-updaters with unverified downloads are a well-known attack vector in malware and supply chain threats. When domain ownership lapses, attackers can take over the infrastructure and push unsafe code to large numbers of users.
Users who installed any version of Popcorn Time should double-check whether Time4Popcorn is in their Applications folder or startup scripts. If unsure, system tools that list login items or launch agents can help uncover the updater. High caution is warranted especially because the state of the app’s update mechanism is unknowable in many cases.
If you’re still running Time4Popcorn, act fast: uninstall it, remove its updater, and scan your system for any unusual startup entries. Since this issue was discovered, efforts by Eye Research and Shadowserver have staved off immediate threats—but lingering risk remains wherever domains aren’t yet recovered or where older vulnerabilities stay unpatched.
Seeing this kind of exposure from a forgotten app highlights a key reality in cybersecurity: maintenance matters just as much as original design. Unmaintained software, especially when it includes auto-update components, can turn into serious liabilities over time. What to watch for now are further reports of abuse, potential software that mimics Time4Popcorn to exploit the same flaw, and more robust tools in macOS to flag unverified updaters and expired domains tied to active components.
