If you installed Popcorn Time on a Mac years ago, part of the app may still be running, leaving your device vulnerable to attack. Security firm Eye Research detailed how Time4Popcorn, an unofficial version of the once-popular movie streaming app, left behind a small update checker that scanned for updates every time the Mac started, even for users who had not opened the app in years. The checker trusted whatever it downloaded and gave it full permission to change anything on the Mac.
Because the developers abandoned the project, the website addresses the helper contacted were expiring, meaning anyone who took over one of these addresses could install harmful software on affected machines. Eye Research estimates 250,000 to 350,000 Macs were affected. With no developer to issue a fix, researchers used the checker itself to disable it on over a million Macs and Windows PCs, then handed the addresses to the Shadowserver Foundation.
However, the fix does not address other vulnerabilities in Time4Popcorn, and some updated addresses remain outside researchers' control. If you are still running that version, the advice is simple: uninstall it. Time4Popcorn was distributed under the Popcorn Time name, so users may not know if their copy is affected.
Source: MacRumors · Summarized by HeadlinesBriefing