Abandoned Popcorn Time updater could expose millions of devices

Eye Security has highlighted a long-running updater tied to a modified version of Time4Popcorn, a 2014-era BitTorrent client. The firm found that the updater continued to run on more than 2.5 million Windows machines and around 300,000 Macs, even after a decade, periodically checking for new software. Crucially, many of the domains it queried were open to registration, enabling potential attackers to register them and push software onto millions of machines. Eye Security updated the code to stop the automated process of contacting the old domains.

The issue underscores the risk posed by abandoned infrastructure and “dropcatch” domains—domains that have been left behind by legitimate services and later acquired by others, including criminal operators. The advisory notes that, without a vendor patch, there was no straightforward fix for affected users.

The report cites input from Niels Teusink of Eye Security and Ben Harris, founder of watchTowr, who explain how AI can speed up the research attackers need to identify unregistered or abandoned domains and to map out the software the domains reach out to. Industry voices, including Renée Burton of Infoblox, describe supply-chain implications when such domains are integrated into software, and advocate proactive measures to identify and intervene with high-value pending drop domains before misuse.