BambooToken Malware Exploits MQTT Protocol to Target Windows and Linux

Security researchers at Lumen Black Lotus Labs have uncovered a sophisticated multi-platform malware campaign dubbed BambooToken, which leverages the lightweight Message Queueing Telemetry Transport (MQTT) protocol as a covert command-and-control (C2) channel. Active since at least February 2023, BambooToken has been observed targeting organizations across Asia and South America, with the most recent activity detected in July 2026. The previously undocumented malware family was first identified on VirusTotal in early 2026, indicating a highly skilled threat actor capable of evading detection for extended periods.

The initial access vector relies on DLL sideloading through Tendyron's "OnKey" software, a second-generation Public Key Infrastructure (PKI) USB security token widely used in China's financial and government sectors. Tendyron claims 190 million tokens in circulation, making its software a high-value target. While neither Tendyron's code-signing certificate nor its build environment has been compromised, the operators exploit vulnerable binaries to silently load malicious agents into networks already running the authentication program. Most BambooToken samples uploaded to VirusTotal originate from Chinese IP address space, suggesting a data collection campaign targeting users within China and neighboring regions.

BambooToken shares tactical similarities with other MQTT-based threats, including Mustang Panda's MQsTTang backdoor, the Tizi Android spyware, the WailingCrab loader attributed to the Bamboo Spider cybercrime group, and the IOCONTROL OT malware targeting IoT and SCADA systems. Early BambooToken variants extract the C2 server address from a .DAT configuration file or fall back to a hard-coded server. Once connected via the publish-subscribe MQTT protocol, operators can issue commands to compromised Windows and Linux hosts, blending malicious traffic with legitimate IoT messaging.

The campaign underscores how attackers continue to repurpose benign protocols for stealthy operations. Defenders should audit MQTT broker exposures, monitor for unauthorized DLL sideloading activity, and review endpoint logs for anomalies. Organizations concerned about their network exposure can run a port scanner to identify open MQTT ports and use a WHOIS lookup to investigate suspicious server infrastructure. For broader security hygiene, a privacy checkup can help identify other overlooked attack surfaces in your environment.