Malware 'Recommended Video Player' Infects Over 700,000 Devices in China

China's National Internet Emergency Center (CNCERT) has issued a risk warning regarding the widespread distribution of malware known as "Recommended Video Player." This application contains a backdoor that allows it to collect terminal information without user consent, download and execute other programs, and receive server commands to run arbitrary code.

According to CNCERT, the malware poses security risks, including potential remote control of infected devices and leakage of personal information. Over 700,000 devices in China have been detected as infected. The program maintains persistence through startup items and system services, enabling silent installation of third-party software, collection of device fingerprint and behavioral data, and manipulation of clipboard content.

The malware utilizes two separate communication channels to periodically receive and execute scripts from a remote server. Analysis indicates that while communication domains, interfaces, and encryption methods have been altered, the core malicious behaviors, such as script execution and data collection, remain consistent. Between September 15-22, 2026, CNCERT monitored over 700,260 infected devices within China, with a peak of 251,880 controlled terminals online daily.

CNCERT advises users to download software only from official channels and to verify digital signatures. They recommend comprehensive scanning of infected terminals and suggest system reinstallation for compromised devices. Network security measures should include blocking identified malicious domains and IPs, while endpoint protection should be enhanced with updated security software and strict privilege management.