Eye Security's data shows the vulnerable Time4Popcorn updater on corporate and government networks, usually on machines where nobody uses the app anymore.

• Windows: a service named Update service running C:\Program Files (x86)\Popcorn Time\Updater.exe or C:\Program Files\Popcorn Time\Updater.exe. Query your EDR or software inventory for that path and service name.
• macOS: /Library/PrivilegedHelperTools/PT.updd with /Library/LaunchDaemons/PT.updd.plist.
• Network: DNS or proxy hits for popcorntimeupd.xyz and the other update domains listed in Eye's write-up.
• Fix: uninstall the app. If you need a stopgap, Eye gives sc.exe stop "Update service" then sc.exe config "Update service" start= disabled on Windows, and launchctl unload -w /Library/LaunchDaemons/PT.updd.plist on macOS. Android installs can only be removed.

Same lesson applies beyond this app: any unsigned, plain-HTTP auto-updater pointed at a domain that can lapse is a remote-code-execution path waiting for a buyer.