Legacy Popcorn Time Updater Could Let Domain Controllers Push Code to Millions of Devices
Summary
Eye Security found a legacy Time4Popcorn updater still running on over 2.5 million Windows machines and an estimated 300,000 Macs. Abandoned domains it queried could let a controller deliver executable code with high privileges.
Key points
- Eye Security reported that the legacy updater remained active on more than 2.5 million Windows machines and an estimated 300,000 Macs.
- The updater queried outdated domains, some of which were available for registration, creating a potential route to deliver software to systems.
- Eye Security said the updater could download and execute a supplied executable with high privileges; the process used HTTP and lacked code signing.
- Eye Security modified the updater to stop its automated requests to the old domains.
- The article recommends tracking domains used by employees’ devices, including remote and BYOD systems, and monitoring abandoned software infrastructure.
Article Details
- Event Type
- Security risk from an abandoned software updater that continued querying domains available for registration.
- Impact
- The legacy Time4Popcorn updater reportedly remained active on more than 2.5 million Windows machines and an estimated 300,000 Macs. Eye Security found that the updater could download and execute an executable with high privileges over HTTP, without code signing. If an attacker registered a queried domain, they could potentially use it to deliver code to affected systems. The article reports this exposure, not confirmed exploitation.
People
Benjamin HarrisFounder and CEO of watchTowr who discussed how AI could help identify abandoned software infrastructure and domains that might be hijacked.Niels TeusinkPrincipal security researcher at Eye Security who analyzed the legacy updater and described its ability to download and execute code with high privileges.Renée BurtonVice president of threat intelligence at Infoblox who explained the supply-chain risks of dropped domains and Infoblox's efforts to register some of them.
Vendors
Eye SecurityWhen managed security service provider Eye Security spotted an odd update process in a client's telemetry that appeared to be reaching out to outdated — and in some cases, malicious — domains, the company decided toInfobloxtraffic they attract, says Renée Burton, vice president of threat intelligence at cybersecurity vendor Infoblox.watchTowRor sold off, legacy software infrastructure. In February 2025, for example, exposure management firm watchTowr discovered 150 Amazon S3 buckets that had been abandoned, so they registered and found that more than 8