EXPLORINEER
en

DE — heise online

Popcorn Time: Abandoned Update Servers Threatened Mac Users

Security1 min read

Security researchers at Eye Research found that old update servers for a Popcorn Time app variant could have been taken over. That would have let attackers run code on Macs, Windows PCs and Android phones. Instead, Eye Research took control of the servers itself and pushed a fix.

What happened

Popcorn Time was once a famous app for streaming movies, many of them copied illegally, without downloading them first. A version of it, called Time4Popcorn, is still on some computers. Its update servers had been abandoned by the original makers. Eye Research found that an attacker could take over those servers and run any code on the computers that used the app. On macOS, this could even be done with root rights, which means full control of the system.

Key numbers and facts

  • The problem was found in November 2025.
  • At first, Eye Research estimated up to 1.7 million macOS computers were affected.
  • The researchers now estimate 250,000 to 350,000 machines were affected.
  • The updater ran at every system start, and sometimes more often.
  • Windows and Android were also affected.

Why the old app was risky

The app still checks home servers for updates, even though no one develops it anymore. When nobody controls those servers, someone else can take them over. The updater then sends harmful code to the user's computer. Such a setup is a common way attackers build botnets, which are groups of hacked devices they can control.

Why it matters

Eye Research did not ask users for permission before it changed the servers. Its patch was even flagged as malware on VirusTotal, a site that checks files for viruses. The patch only blocks the risky updater. The app itself still has security holes, so users should remove it. Eye Research also gave the domains to the Shadowserver Foundation, a group that fights these kinds of attacks.

What to watch

  • Whether more affected computers get cleaned up or stop using the old app.
  • How the Shadowserver Foundation monitors the domains.
  • Details from Eye Research's talk at the hack.lu conference.

Glossary

Popcorn Time
An app that lets people watch movies by streaming them, often without permission from the copyright owners.
Time4Popcorn
An alternative version of Popcorn Time that is no longer updated but still checks for updates.
Eye Research
A security company that found this problem and fixed it by taking over the old servers.
Shadowserver Foundation
A non-profit group that tracks and fights cyberattacks and watches the risky domains.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityZDNet Korea

Column on Security: The Fall of Human-Centered Cybersecurity

This ZDNet Korea column argues that this autumn's wave of breaches across Korea's financial sector, which the authorities say has hit 16 firms, exposed the limits of human-operated, patch-centered defense. It contrasts these attacks with historical examples such as the Opium War and calls for zero trust, AI-assisted defense, and leadership that measures security by how quickly intrusions are detected and stopped.

SecurityThe Register

Anthropic: That Claude Code extension compromise… couldn't be us

Anthropic denied that a malicious version of its Claude Code extension, published to Cursor's marketplace and reportedly infecting up to 5,000 developers, stemmed from a breach of its own systems. Felix Rieseberg of Anthropic's technical staff said a malicious actor used access to Cursor's marketplace to publish the tampered extension, version 2.1.313, which contained a persistent SSH backdoor and was available for about 11 hours. Cursor said it removed the version, shut down the VSCode Marketplace as a precaution, and has not explained how the package reached the marketplace.

SecurityArs Technica

GM to pay $220 million after selling customer Smart Driver data

General Motors will pay $220 million to settle claims over sharing Smart Driver customer data with brokers, who sold it to insurers, raising some drivers' premiums. The settlement covers the District of Columbia and 35 states whose attorneys general sued GM, and it follows an earlier FTC settlement that bans sharing certain driver data for five years. Under the new terms, a third party will verify GM's compliance with its privacy policy.

SecurityITmedia

Report: Japan's MIC asks telecom carriers to block GMO attacker sites

According to reports from Asahi, Yomiuri, Nikkei and others on October 29, the Ministry of Internal Affairs and Communications asked telecom providers to forcibly block access to attacker-run websites that posted personal information allegedly belonging to GMO Internet customers. The request, dated October 27, was relayed to carriers through four telecom industry groups, and carriers have not disclosed whether they carried out any blocking. GMO said on October 28 that it had confirmed the domains of the attacker sites, including mirror sites, were shut down.