Researchers Hijack Abandoned Popcorn Time to Kill Zombie Botnet

The security team identified that the software's update mechanism was still phoning home to expired domains over unencrypted HTTP connections. Because these domains were abandoned, an attacker could have easily seized control to push arbitrary code, conduct surveillance, or execute man-in-the-middle attacks on unsuspecting users across Windows, macOS, and Android platforms. Niels Teusink, a researcher at Eye Security, noted that the updater operated with full system privileges, effectively leaving a door wide open for any threat actor to commandeer the hardware.

To mitigate the danger, the researchers registered one of the expired domains themselves. They pushed a benign update designed specifically to disable the vulnerable service. On Windows, this meant halting the process via the Service Control Manager, while macOS users received a shell script to block the updater from launching. By March, the team had distributed over 2 million of these kill-switches before transferring control of the domains to the Shadowserver Foundation. The intervention was not without friction; security software initially flagged the fix as malware, forcing the team to refine their approach to ensure the vulnerable code was successfully silenced.