Something’s off.According to the report, the abandoned Time4Popcorn app still had an updater contacting its former update domain. The updater reportedly used unencrypted HTTP and accepted executables without checking digital signatures, meaning someone controlling that domain could potentially send privileged code to the computers still checking in.
Researchers said they registered the domain and saw as many as 3 million Windows and 350,000 macOS connections, even though the users did not appear to be actively using the app. They then reported using that same update channel to send code that stopped and disabled the updater. The strange reversal is that a forgotten app’s automatic update feature was reportedly still reaching out at scale—and the vulnerable channel was used to shut itself down.
The researchers said about 2 million remediation downloads were recorded and requests fell 98% by March 1. They also warned that Android installations and the app’s outdated Chrome engine could still pose risks, and recommended removing the software.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This source report has not been independently verified.
