Search — “popcorntimeupd.xyz”

Time4Popcorn's Windows and macOS updater fetched executables over unencrypted HTTP from the abandoned domain popcorntimeupd.xyz without verifying signatures, so a party controlling that domain could run code as SYSTEM on Windows or root on macOS. Eye Security registered the domain, observed up to 3 million Windows and 350,000 macOS client connections, and used the updater to deploy remediation that disabled it; no confirmed malicious exploitation is reported. Defenders should look for Time4Popcorn installs and remove them, since Android users could not be remediated remotely.