GoKawiilEye Security finds abandoned Popcorn Time updater still live on millions of PCs
Eye Security researchers discovered that a modified updater from the 2014 BitTorrent client Time4Popcorn was still silently running on more than 2.5 million Windows machines and roughly 300,000 Macs. The updater regularly checked in with domains that had since become available for registration, meaning anyone could buy one and push code with full system privileges to affected machines. Eye Security said it acted to secure the domains itself since no vendor remained to patch the abandoned software.
GoKawiil's interpretation of the reporting above, not reported fact.
The discovery illustrates a broader supply-chain risk: software long considered dead can leave persistent background processes that still trust old infrastructure, creating an open door for attackers who register lapsed domains. This pattern, also seen in abandoned cloud storage buckets, suggests organizations and individuals may be exposed through software they forgot was ever installed, with no vendor accountable for fixing it.
- An abandoned Time4Popcorn updater remained active on millions of devices a decade after the software's creation.
- Many of its update domains had lapsed and become open to registration, posing a hijack risk.
- Eye Security intervened to secure the domains itself due to the lack of a responsible vendor.
Malwarebytes Premium Security Software — Zombie updaters like the one found in old Popcorn Time installs show how outdated software can quietly phone home to malicious domains for years. Real-time malware protection like Malwarebytes Premium can catch and block these rogue connections before they turn into a full breach, giving home and small-business users an extra layer of defense against forgotten software risks.
See Malwarebytes Premium Security Software on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Robert Lemos, 2026-10-30
Published there as: “Undead Software Projects Continue to Raise Security Risks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.