An abandoned Popcorn Time updater left up to 350,000 Macs vulnerable to remote takeover, giving potential attackers a way to execute malicious code with full system privileges.

Security researchers at Eye Research detailed the discovery in an October 22, 2026, research report about Operation IXIM. The vulnerability affected Time4Popcorn, an abandoned fork of the popular BitTorrent streaming application that continued circulating under the Popcorn Time name after the original project shut down in 2014.

Some users had stopped using Popcorn Time, but its updater kept running. Eye Research discovered attackers could hijack it to install malware and intervened between November 2025 and March 2026.

How a forgotten updater exposed hundreds of thousands of Macs

The investigation began when Eye Research discovered an updater contacting an abandoned domain from a customer's Windows computer.…