If you installed the unofficial Popcorn Time client on a Mac years ago, a hidden component may still be active, silently checking for updates each time you start your computer. Security researchers have confirmed that the old Popcorn Time app left a small update checker running in the background, exposing hundreds of thousands of Macs to potential attack.
Why the Old Popcorn Time app is still scanning Macs
The version in question, known as Time4Popcorn, was an unofficial fork of the popular streaming service that let users watch movies via BitTorrent. Although the main application was often removed after use, the installer also dropped a lightweight daemon that was designed to query a remote server for newer releases.
Eye Research discovered that this daemon persists even when the user never launches the app again. Because it is triggered at system startup, it can operate without any visible sign, creating a network connection that could be hijacked or used to deliver malicious payloads.
What makes the residual component a security concern?
The update checker runs with the same privileges as the user who installed the original software. If an attacker intercepts the check-in request, they could supply a crafted response that executes code on the Mac. The risk is amplified by the sheer number of devices that once installed the app, as suggested by the “hundreds of thousands” estimate.
Furthermore, the daemon was not signed by Apple, meaning it bypasses the usual Gatekeeper verification that helps protect macOS users from unsigned software. This lack of signing makes it easier for malicious actors to exploit the lingering process.
How the issue was uncovered
Eye Research detailed their analysis after receiving reports of unusual network traffic originating from Macs that no longer had Popcorn Time installed. Their investigation traced the traffic back to a residual launch agent that belonged to the Time4Popcorn package.
The researchers highlighted that the component checks for updates on every boot, regardless of whether the user interacts with the original application. This behavior explains why many users remain unaware of its presence.
Steps Mac owners can take right now
Removing the hidden updater is straightforward for most users. Open the Terminal and run the following command to list launch agents related to Popcorn Time:
- launchctl list | grep -i popcorn
If an entry appears, you can unload and delete it with:
- launchctl unload -w ~/Library/LaunchAgents/com.popcorn.time.update.plist
- rm ~/Library/LaunchAgents/com.popcorn.time.update.plist
For those uncomfortable with the command line, the macOS Activity Monitor can help locate suspicious processes, and the System Settings > Privacy & Security > Login Items pane may show the offending item.
After removal, it is advisable to run a reputable anti‑malware scan to ensure no additional remnants remain.
Preventing similar risks in the future
Mac users should be cautious when installing unofficial software, especially applications that modify system launch agents. Always verify that a program is signed by a trusted developer and consider using a dedicated sandbox or virtual machine for experimental apps.
Keeping macOS up to date also reduces the attack surface, as newer versions tighten security around unsigned launch agents and improve network monitoring tools.
This article is based on publicly reported information at the time of writing.
