Undead Software Projects Continue to Raise Security Risks

A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.

When managed security service provider Eye Security spotted an odd update process in a client’s telemetry that appeared to be reaching out to outdated — and in some cases, malicious — domains, the company decided to take a deeper look.

The updater belonged to a modified version of Time4Popcorn, a 2014-era BitTorrent client that allows movies to be downloaded from the Internet, and even after a decade the persistent updater continued to run on more than 2.5 million Windows machines and an estimated 300,000 Macs, checking for new software, according to the MSSP‘s advisory. The problem: Many of the domains checked by the updater were open to registration, which could allow any would-be cyberattacker to register the domain and have an easy way to place software on millions of machines.

The situation highlights the issue of old infrastructure and the threat it poses to users and businesses, especially if the business’s employees work from home, Niels Teusink, principal security researcher for Eye Security, wrote in the analysis.

“[W]hile these users chose to install Popcorn Time, none of them chose to have a forgotten updater running in the background for years, ready to run any code with full privileges for whoever controlled one of its domains,” the company stated in its advisory. “With millions of systems affected and the software long abandoned, there was no vendor to fix this and no patch on the way: if we didn’t act, nobody would.”

The risk of domains that are dropped by a legitimate service and then picked up again, or bought by a gray-market or criminal operator — sometimes called “dropcatch domains” — have become an increasing issue as developers have stopped updating, or sold off, legacy software infrastructure. In February 2025, for example, exposure management firm watchTowr discovered 150 Amazon S3 buckets that had been abandoned, so they registered and found that more than 8 million HTTP requests from government and companies came in for resources that had been hosted at those addresses.

And with AI enabling a more sophisticated analysis of software projects, attackers may be able to more quickly do the necessary research to find domains that could be a backdoor into users’ systems, says Benjamin Harris, founder and CEO of watchTowr.

“AI is definitely driving the barrier-to-entry down for this kind of research very quickly,” he says. “We’re seeing AI used to reproduce vulnerabilities, find zero days, but applied to this, AI can be used to install a bunch of software, install network taps, see what all the software reaches out to, see what’s not registered, or see what’s been abandoned, and what we can hijack.”

Dropcatch Domains: A Hidden Risk

Typically, there are two types of vulnerable domains that questionable operators might take an interest in. The first are homograph domains that look like their legitimate cousins and include both typosquatting domains, such as “gmai[.]com,” that try to catch browsers whose users mistyped a URL, and lookalike domains that are used in phishing to visually fool users. The value of these types of domains to the owner varies, depending on the amount of traffic they attract, says Renée Burton, vice president of threat intelligence at cybersecurity vendor Infoblox.

However, dropcatch domains that are integrated into the supply chain for a piece of software are a completely different — and more serious — risk, she says. Infoblox has registered hundreds of domains that had been part of supply chains to prevent attackers from using them.

“Supply chain attacks can happen at a moment’s notice, and depending on how dropped domains are integrated into existing software, a threat actor can quickly abuse a supply chain dropped domain to conduct sophisticated attacks that lead to data loss and ransomware,” Burton says.

In 2024, Chinese company Funnull bought the polyfill[.]io domain from the creator of the Polyfill service and began redirecting users to tens of thousands of websites.

The Popcorn Time issue highlights the problem. Anyone with access to the domains, and with some reverse engineering, could figure out how to tinker with the legacy updaters. In fact, that’s what Eye Security did, updating the code to stop the automated process of reaching out to the old domains.

“All we needed to do was supply a link to an executable and the program would download it and then execute it with high privileges (NT AUTHORITYSYSTEM),” Teusink wrote. “There was no code signing and this process was all happening over HTTP.”

Eye Security stressed that another project, confusingly also named Popcorn Time, is a 2025 effort to create a legitimate streaming service and is not impacted by the legacy update issues.

Know Your Internet Services

Companies should know the domains that their employees are reaching out to and the reputation of those domains, and should extend that monitoring and protection to remote users, says watchTowr’s Harris.

“The big challenge with things like BYOD and working from home is that now the network perimeter extends from not just your corporate network, … but the user’s home network as well,” he says.

The community needs to come together as well, says Infoblox’s Burton. While taking active defense to the same extent as Eye Security continues to be legally problematic, finding legacy and unused infrastructure is something that security communities on the Internet can continue to work on, she says.

“Threat actors understand the value of controlling a domain which is integrated into an existing supply chain and being queried by real people on a regular basis,” Burton says. “We need more defenders looking for proactive ways to disrupt domain drop schemes by purchasing high-value pending drop domains before threat actors, and by looking for ways to reduce threat actors cash out opportunities from these attacks.”