--- title: Undead Software Projects Continue to Raise Security Risks description: Eye Security found that a decade-old updater from the 2014 BitTorrent client Time4Popcorn was still running on more than 2.5 million Windows machines and an... canonical: https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Undead Software Projects Continue to Raise Security Risks | daily.dev og:description: Eye Security found that a decade-old updater from the 2014 BitTorrent client Time4Popcorn was still running on more than 2.5 million Windows machines and an... og:url: https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs og:image: https://api.daily.dev/og/posts/VUxquoJCs.png og:image:alt: Undead Software Projects Continue to Raise Security Risks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Undead Software Projects Continue to Raise Security Risks **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Eye Security found that a decade-old updater from the 2014 BitTorrent client Time4Popcorn was still running on more than 2.5 million Windows machines and an estimated 300,000 Macs, reaching out to domains, many of which were open to registration. Anyone could have registered one of those domains and pushed code that ran with NT AUTHORITY\SYSTEM privileges, since there was no code signing and the updater used plain HTTP. Eye Security patched the code itself to stop the callouts, since there was no vendor left to fix it. The piece ties this to other dropcatch domain incidents: watchTowr registered 150 abandoned AWS S3 buckets in February 2025 and found more than 8 million HTTP requests from government and companies to them, and in 2024 Funnull bought the polyfill.io domain from the creator of the service and redirected users to tens of thousands of websites. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened with the old Popcorn Time updater and why was it a security risk? A modified Time4Popcorn BitTorrent client from 2014 still ran a background updater on more than 2.5 million Windows machines and about 300,000 Macs. It checked domains that were open for registration, and anyone who registered one could push an executable that ran with NT AUTHORITY\SYSTEM privileges over plain HTTP, with no code signing. Eye Security patched the code itself since no vendor remained to fix it. _daily.dev surfaces supply chain incidents like dropcatch domains for teams auditing legacy dependencies._ ### What is a dropcatch domain attack in software supply chains? It is when an attacker registers a domain abandoned by a legitimate service that is still referenced by deployed software, then uses it to deliver malicious code. Examples include the 2024 Funnull purchase of the abandoned polyfill.io domain, which redirected tens of thousands of websites, and watchTowr's 2025 registration of 150 abandoned AWS S3 buckets that received over 8 million requests. _teams tracking third-party dependency risk follow cases like this on daily.dev before they get burned._ ## Similar posts on daily.dev - [Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks](https://daily.dev/posts/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks-lln9cssgx) · BleepingComputer · 0 upvotes · 0 comments - ['Harmless' Global Adware Transforms Into an AV Killer](https://daily.dev/posts/harmless-global-adware-transforms-into-an-av-killer-odjt9mgeg) · Dark Reading · 0 upvotes · 0 comments - [11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windo...](https://daily.dev/posts/11-malicious-nuget-tools-pose-as-game-cheats-to-drop-a-windo--rraw5qijj) · Socket · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Undead Software Projects Continue to Raise Security Risks","url":"https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs"},"datePublished":"2026-10-30T14:29:39.651Z","dateModified":"2026-10-30T14:30:12.625Z","description":"Eye Security found that a decade-old updater from the 2014 BitTorrent client Time4Popcorn was still running on more than 2.5 million Windows machines and an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d7d72b2c2116e244d0b2a7c37679df2e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d7d72b2c2116e244d0b2a7c37679df2e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,appsec","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Undead Software Projects Continue to Raise Security Risks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/undead-software-projects-continue-to-raise-security-risks-vuxquojcs#faq","mainEntity":[{"@type":"Question","name":"What happened with the old Popcorn Time updater and why was it a security risk?","acceptedAnswer":{"@type":"Answer","text":"A modified Time4Popcorn BitTorrent client from 2014 still ran a background updater on more than 2.5 million Windows machines and about 300,000 Macs. It checked domains that were open for registration, and anyone who registered one could push an executable that ran with NT AUTHORITY\\SYSTEM privileges over plain HTTP, with no code signing. Eye Security patched the code itself since no vendor remained to fix it. daily.dev surfaces supply chain incidents like dropcatch domains for teams auditing legacy dependencies."}},{"@type":"Question","name":"What is a dropcatch domain attack in software supply chains?","acceptedAnswer":{"@type":"Answer","text":"It is when an attacker registers a domain abandoned by a legitimate service that is still referenced by deployed software, then uses it to deliver malicious code. Examples include the 2024 Funnull purchase of the abandoned polyfill.io domain, which redirected tens of thousands of websites, and watchTowr's 2025 registration of 150 abandoned AWS S3 buckets that received over 8 million requests. teams tracking third-party dependency risk follow cases like this on daily.dev before they get burned."}}]} ```