An abandoned Popcorn Time updater ran as SYSTEM and fetched code over plain HTTP, making it a ready-made botnet for…