A malicious update could infect millions of devices without users ever knowing.