CNCERT warns that the Jianpian Player for Windows has a built-in backdoor and has infected more than 700,000 devices

China’s CNCERT warned on 9 October that the Windows “Jianpian Player” downloaded from the so-called official Jianpian site (www.jianpian.com, which it said is not a legally registered mainland site) contains a backdoor that can quietly collect device information, download and run other programs, and execute arbitrary code from a command server, creating risks of remote control and personal-data leakage ^[1]. It said it observed 700,260 infected devices in mainland China from 15 to 22 September 2026, with as many as 251,880 controlled devices online in a single day, and that the program can silently install third-party software, collect device fingerprints and usage data, and tamper with the clipboard ^[1]. CNCERT advised people not to download bundled video-player software from unofficial channels, to check the digital-signature owner, and, if a device is confirmed infected, to treat it as compromised, isolate it and reinstall the system, while keeping endpoint protection updated and not using an administrator account for everyday work ^[1].

Industries mainly affected: Cross-industry

1. Do not download bundled video players from unofficial channels; check the digital-signature owner and watch for pre-ticked bundle options during setup .