Popcorn Time fork updater left devices open to hijacking, Malwarebytes reports

What happened

According to Malwarebytes, researchers at Eye Security found that the abandoned updater in Time4Popcorn, a fork of the Popcorn Time streaming app that was also distributed under the name “Popcorn Time”, could have let attackers run code on Windows and Mac computers. This could happen even if the owner had not opened the app in years.

Malwarebytes reports the following:

• Time4Popcorn was abandoned, but its update infrastructure kept running on users’ devices. The domains associated with the software later became available for others to register.
• The updater used unencrypted HTTP and accepted executable updates without checking digital signatures. Anyone who controlled an update domain, or could tamper with the traffic, could supply their own program.
• This remote code execution flaw is tracked as CVE-2026-30612.
• Eye Security estimates the updater was present on 2.5 to 3 million Windows computers and around 250,000 to 350,000 Macs.
• Android was also affected. There, the updater checked for updates when the app was opened, and installing an attacker-supplied APK required user approval. Malwarebytes says this was not the same silent background route as on desktop.

Eye Security’s intervention, as described by Malwarebytes:

• Eye Security registered an abandoned update domain and used the updater to push an update that disables the updater itself. On Windows, the update stopped and disabled the service. On macOS, it prevented the update process from starting.
• The researchers say the intervention did not delete files or collect host data.
• By March 2026, Eye Security reported more than two million downloads of the fix, and update requests to its domains had fallen by 98%.
• Eye Security then transferred the 15 domains it controlled to the nonprofit Shadowserver Foundation.

Some things remain unresolved or unconfirmed:

• The Android updater could not be disabled remotely.
• The desktop app still has other weaknesses, including a Chrome engine from 2014 and disabled sandbox protections.
• Whether any attacker exploited the flaw before the intervention is not confirmed in the source.
• The CVSS score and the content of the official CVE record are not confirmed in the sources provided.

Am I affected?

You may be affected if any of your devices has Popcorn Time or Time4Popcorn installed, including old or forgotten Windows PCs, Macs or Android devices, according to Malwarebytes. Because the fork used both names, you may have it without ever seeing “Time4Popcorn”.

Components to look for, as identified by Eye Security and reported by Malwarebytes:

• Windows: Updater.exe, normally in a Popcorn Time folder under Program Files or Program Files (x86), running as a service called Update Service.
• macOS: /Library/PrivilegedHelperTools/PT.updd, with a launch daemon at /Library/LaunchDaemons/PT.updd.plist.

What to do now

1. Check installed applications on every device for Popcorn Time or Time4Popcorn, per Malwarebytes.
2. Remove the application. Malwarebytes says there is no vendor security update for the abandoned software, and disabling the updater does not fix its other weaknesses.
3. On Windows, confirm the Update Service and Updater.exe are no longer running. On macOS, confirm PT.updd and its launch daemon are gone or disabled.
4. On Android, uninstall the app and do not accept any update prompt from it. Malwarebytes says the updater is part of the main app and cannot easily be disabled on its own.
5. Run up-to-date anti-malware on any device where the updater was present, as Malwarebytes recommends.

Sources

• Malwarebytes: Popcorn Time’s forgotten updater left millions of devices exposed to hijacking
• NVD: CVE-2026-30612