The Popcorn Time app was a once-popular, if questionable, way to view movies, films, and other content, but if you’re one of the many users that installed a certain version of it on your Mac, lo those many years ago, your Mac could be open to attack.
As reported by MacRumors, Security firm Eye Research has detailed how Time4Popcorn, which was an unofficial version of the app, left behind a small update checker app that checks for an update every time you fire your Mac up. This happens even if you haven’t opened the app in years! The problem is that the checker blithely trusted whatever it downloaded, giving it full permission to change anything on your Mac.
It didn’t matter that the Time4Popcorn fork’s developers long ago stopped working on the app, abandoning the website addresses the helper app contacted. Since they were expiring, anyone that took over one of the addresses could use it to install whatever they wanted onto your computer. Happily, Eye Research says their investigation didn;t find any evidence of bad actors doing so.
(It should be noted that in early 2025 a new project started using the Popcorn Time name and is building a legal alternative, which appears to try and make it easier to view what you enjoy from the various streaming services you subscribe to. Eye Research’s findings do not apply to that software.)
When Eye Research took control of an abandoned address used by the update checker, it found that an estimated 250,000 to 350,000 Macs were affected. The researchers then took it upon themselves to use the checker itself to disable it on more than a million Macs and Windows PCs. It then handed over the addresses to the Shadowserver Foundation, which is a nonprofit cybersecurity group.
The researchers advise anyone that is still using the Time4Popcorn to immediately uninstall it, as some updated addresses remain outside the researchers’ control.
For more details, read the Eye Research report. It is definitely recommended reading.
