Recently, the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC) issued a risk alert, stating that monitoring had detected a backdoor function built into the Windows application of "Jianpian Player." Currently, over 700,000 devices within China have been infected.
According to reports, the software can collect terminal information, download and run other programs without the user's knowledge, and receive commands from the server to execute arbitrary code, posing security risks such as remote control of terminals and leakage of personal information.
Analysis by CNCERT/CC found that while Jianpian Player provides video playback functionality, it also maintains background operation through registry auto-start entries and system services. It possesses capabilities such as silently installing third-party software, collecting terminal fingerprint and behavioral data, and tampering with clipboard content.
Its two built-in independent communication channels can regularly receive and execute scripts distributed by the server. Combined with process injection, kernel driver loading, and in-memory execution capabilities, this allows the server to continuously deliver and run other programs on the terminal.
Comparisons of different versions revealed that although the software has adjusted its communication domains, interfaces, and encryption methods, major malicious behaviors such as script distribution and execution, terminal information collection, and process injection still persist.
Monitoring data shows that between September 15 and 22, 2026, a total of 700,260 devices within China were infected with this malware, with the daily number of active compromised terminals reaching a peak of 251,880.
In response, CNCERT/CC advises users to avoid downloading media players from unofficial channels, verify digital signatures when installing software, and be wary of bundled installation options that are selected by default.
For computers suspected of being infected, promptly use security software to conduct a comprehensive scan, checking for and removing malicious programs.
Authorities specifically emphasized that terminals confirmed to be infected should be treated as compromised hosts. It is recommended to isolate them for investigation first, then reinstall the operating system.