Abandoned Popcorn Time updater risked takeover of millions of PCs
Eye Security sinkholed updater domains and pushed a disabling update to about 2 million Windows and macOS systems.
68
Organization
The Shadowserver Foundation
- Mentions · 7d0
- Mentions · 30d2
- All mentions6
- First seenSep 22, 2026
- Last mentioned15d ago
Timeline
6 articles · newest firstAbandoned Time4Popcorn updater allowed RCE over plain HTTP
Eye Security counted up to 3 million Windows and 350,000 macOS clients calling the domain it registered.
68
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
75
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
84
Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.
58
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
77
Related CVEs
by mentions- CVE-2026-30612<1%9.8Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android)
Appears with
- TRM Labsorganization · 4
- OpenAIorganization · 4
- Microsoftorganization · 4
- Cloudflareorganization · 4
- Health-ISACorganization · 4
- Railwayorganization · 3
- Microsoftvendor · 3
- Coinbaseorganization · 3
- Metropolitan Police Serviceorganization · 3
- SpyCloudorganization · 3
- Time4Popcornproduct · 2
- Microsoft 365product · 2
- Eye Securityorganization · 2
- Popcorn Timeproduct · 2
- SSTPproduct · 1
- EvilTokensorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.