Abandoned software projects keep handing attackers a way in

The updater nobody was watching

Eye Security found the problem in a client's telemetry: an update process reaching out to outdated domains, some of them already malicious. The updater belonged to a modified version of Time4Popcorn, a 2014-era BitTorrent client, and a decade later it was still running on more than 2.5 million Windows machines and an estimated 300,000 Macs, checking for new software, according to the MSSP's advisory.

The exposure is not the client itself. Many of the domains the updater checked were open to registration, so anyone willing to buy one could answer the check and hand the machine a payload. Eye Security's principal security researcher Niels Teusink wrote that all it took was a link to an executable: the program downloaded it and ran it with high privileges, as NT AUTHORITY\SYSTEM, over HTTP with no code signing.

"While these users chose to install Popcorn Time, none of them chose to have a forgotten updater running in the background for years, ready to run any code with full privileges for whoever controlled one of its domains," the advisory states. With the software long abandoned, there was no vendor to fix it and no patch on the way, which is why Eye Security patched the updater itself to stop it reaching the old domains.

The firm also drew a line under a name collision: a separate 2025 project, confusingly also called Popcorn Time, is a legitimate streaming effort and is not affected by the legacy update issues.

A dropped domain is a supply chain entry point

Domains that a legitimate service drops and someone else picks up, sometimes called dropcatch domains, have become a recurring problem as developers stop maintaining or sell off legacy infrastructure. Renée Burton, vice president of threat intelligence at Infoblox, separates them from the typosquatting and lookalike domains used in phishing, whose value depends on the traffic they attract. A dropcatch domain wired into a product's supply chain is a different order of risk.

"Supply chain attacks can happen at a moment's notice, and depending on how dropped domains are integrated into existing software, a threat actor can quickly abuse a supply chain dropped domain to conduct sophisticated attacks that lead to data loss and ransomware," Burton says. Infoblox has registered hundreds of domains that had been part of supply chains to keep them out of attackers' hands.

The pattern is not confined to hobbyist software. In February 2025, exposure management firm watchTowr found 150 abandoned Amazon S3 buckets, registered them, and recorded more than 8 million HTTP requests from government and company systems for resources that had been hosted at those addresses. In 2024, Chinese company Funnull bought the polyfill.io domain from the creator of the Polyfill service and began redirecting users to tens of thousands of websites.

Benjamin Harris, founder and CEO of watchTowr, argues that AI lowers the barrier to finding these targets. "AI can be used to install a bunch of software, install network taps, see what all the software reaches out to, see what's not registered, or see what's been abandoned and what we can hijack," he says.

What the exposure costs against what the sweep costs

No source here publishes a price for a dropcatch takeover, and none puts a figure on the Popcorn Time exposure beyond the machine counts. That absence is itself the finding: the loss is contingent, so it does not appear on a budget line until it happens, while the work to prevent it is a fixed, small piece of engineering time.

The cost side of the ledger is inventory. A team has to enumerate the domains its software calls, decide which are still under the vendor's control, and check whether the registration lapses. Eye Security's own remediation is the cheapest possible version of the fix: it updated the code to stop the automated process of reaching out to the old domains, which is a code change, not a licence.

The alternative is what Infoblox does at scale, buying pending-drop domains before threat actors can. Burton calls for more defenders to do it: "We need more defenders looking for proactive ways to disrupt domain drop schemes by purchasing high-value pending drop domains before threat actors, and by looking for ways to reduce threat actors cash out opportunities from these attacks." That carries a registration fee per domain and a recurring renewal, and the source does not publish either figure, so a buyer should ask for the registrar's per-domain price and the renewal term before committing.

For an estate, the arithmetic that matters is the number of dead references. A single abandoned updater reached more than 2.5 million Windows machines; a company with a few hundred endpoints inherits the same updater if one of them installed the client, and the per-machine cost of the breach is not published anywhere in these sources.

The line items that move the number

Three things drive the cost of closing this class of exposure. The first is the size of the software inventory: every application the estate runs that phones home is a candidate, and the older it is, the more likely its domains have lapsed. The second is whether the updater runs with elevated privileges, because that decides what a hijacked domain can do. The Popcorn Time updater ran as NT AUTHORITY\SYSTEM, which is the worst case.

The third is the network path. The Popcorn Time updater used HTTP with no code signing, so there was no integrity check to fail and no transport to break. An updater that verifies a signature over HTTPS turns a domain takeover into a much smaller problem, and that is a property of the code, not of the security budget.

Remote work widens the perimeter the inventory has to cover. Harris points out that with BYOD and working from home, "the network perimeter extends from not just your corporate network ... but the user's home network as well." A domain block on the corporate gateway does nothing for a laptop on a home connection, so the control has to sit on the endpoint or in DNS resolution that follows the user.

None of these line items has a published price in the sources. What they have is a published scale: 2.5 million Windows machines and 300,000 Macs for one abandoned client, and 8 million requests for 150 buckets.

Test the model: what changes the answer

If the estate doubles, the inventory work does not double with it. The list of applications and the domains they call is roughly fixed by the software catalogue, so the marginal cost of a second thousand endpoints is the scanning and the endpoint policy, not a second discovery project. The exposure, by contrast, scales with every machine that runs the dead updater.

If the network path changes, the answer changes more than the volume does. Moving an updater from HTTP to signed HTTPS removes the domain-takeover path entirely, which is why Eye Security's fix was a code change rather than a blocklist. A team that can only add DNS filtering is buying time, not closing the hole, because the endpoint still trusts whatever answers.

If the term shortens, the calculus tilts toward buying the domains. A registration renewed year by year is a recurring line, and Infoblox's approach of holding hundreds of supply chain domains is a standing commitment. A company that only needs to cover the life of a legacy application can cap the spend at the remaining support window, which the source does not quantify but the application owner can.

The one number that would settle it is the count of endpoints still running abandoned software that reaches out to registrable domains. Eye Security found its 2.5 million through telemetry, which means the measurement is available to any organisation that already collects endpoint network data.

What would change the answer

A published breach cost from a dropcatch takeover would move this from a hygiene item to a budget line. None of the sources here provides one, and the incidents they describe were caught by researchers registering the domains first, not by attackers exploiting them at scale.

A vendor commitment to hold its domains for the supported life of the product would remove the problem for commercial software. The Popcorn Time case had no vendor left, which is the specific condition that made it unfixable by patch. For anything still supported, the question to put in the renewal is whether the update domains are registered beyond the support end date, and who renews them.

Until then, the control is an inventory question: which dead projects does the stack still call, and who owns the domains behind them. Burton's position is that defenders should buy the high-value pending drops before attackers do. The cost of that is a registrar fee the sources do not publish, which is the first figure to ask for in the call.