LmCast :: Stay tuned in

BambooToken malware controls Windows and Linux systems via MQTT

Recorded: Sept. 15, 2026, 3:27 p.m.

Original Summarized

BambooToken malware controls Windows and Linux systems via MQTT

News

Featured
Latest

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Homebrew 7.0.0 gets built-in GUI, better security controls

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

New Android malware encrypts files, steals data, and harasses victims

BambooToken malware controls Windows and Linux systems via MQTT

Hackers target WordPress sites via third-party WooCommerce plugin

What Zero-Day Response Should Be in the Post-Mythos Era

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityBambooToken malware controls Windows and Linux systems via MQTT

BambooToken malware controls Windows and Linux systems via MQTT

By Bill Toulas

September 15, 2026
11:00 AM
0

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.
The malware adopted MQTT for command-and-control communications in variants developed between 2024 and 2025, compromising servers used by mobile apps, legal and financial services, and software development.
MQTT is a lightweight messaging protocol primarily designed for IoT (Internet of Things) devices. It relies on a central broker and channels called “topics” to relay messages from publishers to subscribers, rather than using direct communication channels.
While MQTT is not novel, it is an uncommon approach, and researchers at cybersecurity company ESET documented an unrelated backdoor called MQsTTang in 2023.
In the case of BambooToken, the infected machine subscribes to topics associated with a unique identifier. The attacker then publishes to those topics the commands to be executed on infected hosts.
The malware publishes status and system information through the broker and receives operator instructions through subscribed topics.

Hardcoded Topics in the malware codeSource: Lumen
This approach has the advantage that infected systems do not connect directly to the attacker’s infrastructure, which increases evasion and resilience. At the same time, communications can be asynchronous, ensuring operational continuity during temporary network disruptions.
A report today from Lumen's research arm, Black Lotus Labs, notes that BambooToken infected systems by side-loading via a digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite.
The researchers recovered a BambooToken plugin that enumerates antivirus products on infected hosts and returns the results to the C2. They also found strings pointing to keylogging, clipboard theft, audio recording, webcam capturing, and screenshot capturing.
However, they retrieved these details from “dead code,” meaning the researchers cannot confidently determine if the referenced modules existed and were used in attacks or were still under development.

Strings found in dead code section of .rdata fileSource: Lumen
The researchers found a Linux variant of the malware, BambooToken version 2.1, as the most recent one (observed in December 2025) that could be linked to the campaign
It also uses MQTT, collects extensive system information, can spawn a command shell, and allows operators to upload, download, and delete files. However, Black Lotus Labs says that "the Linux sample still appeared to be under development."
Lumen’s telemetry identified approximately a dozen compromised enterprise entities, mostly in Asia and South America, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania.
Additionally, the researchers found that the most compromised servers were associated with the backend infrastructure of mobile applications.
The threat actor also compromised a GitLab server in Hong Kong, creating a potential foothold for supply-chain attacks.
Lumen hypothesizes that some of the activity may have targeted overseas Chinese users accessing mainland services through the SpeedCN VPN service.
Although the researchers could not attribute BambooToken activity to a specific threat actor or a known activity cluster, they note that the targeting patterns are consistent with China-aligned operations.
Lumen has shared indicators of compromise (IoCs) associated with this activity to help defenders detect and block the attacks.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat

Related Articles:
New ClickLock macOS malware traps users into revealing login passwordHackers exploit Tencent app flaw to deploy GrayRabbit malwareArtifactory flaws chained in attacks deploying backdoor malwareMFA's Weakest Link: Account Recovery Is the New Attack PathHackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Backdoor
BambooToken
Malware
MQTT

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article

Post a Comment Community Rules

You need to login in order to post a comment
Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

Microsoft releases emergency Windows updates to fix RDS failures

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Microsoft: September updates cause RDS failures on Windows Server

Sponsor Posts

EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.

Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. 

Patch automation needs more than speed. Action1 brings control into every stage of deployment.

Watch a working exploit hit live controls and see exactly what blocks, detects, or misses

Overdue a password health-check? Audit your Active Directory for free

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

A previously unknown malware framework named BambooToken has utilized the Message Queuing Telemetry Transport, or MQTT, protocol to establish command-and-control communications across both Windows and Linux systems. This malware framework became active in at least 2023 and evolved into variants between 2024 and 2025, compromising servers associated with mobile applications, legal and financial services, and software development entities. MQTT, being a lightweight messaging protocol designed primarily for Internet of Things devices, is leveraged by BambooToken through a publish-subscribe model, utilizing a central broker and topics to relay messages rather than relying on direct communication channels.

The mechanism employed by BambooToken involves infected systems subscribing to specific topics identified by a unique marker. Attackers then publish commands to these topics, allowing the malware to execute instructions on the compromised hosts. Furthermore, the malware publishes status updates and system information to the broker while simultaneously receiving operator commands through subscribed topics. This method of communication provides advantages in evasion and resilience because the infected systems do not establish direct connections to the attacker's infrastructure, and the communication can be asynchronous, ensuring operational continuity during network disruptions.

Research conducted by Black Lotus Labs, the research arm of Lumen, involved recovering a BambooToken plugin which was capable of enumerating antivirus products on infected hosts and reporting the results back to the command and control server. During this investigation, researchers also discovered strings within the dead code section of the .rdata file, which pointed to functionalities involving keylogging, clipboard theft, audio recording, webcam capturing, and screenshot capturing, although the existence and usage of these specific modules could not be definitively confirmed.

The malware framework has been linked to infection vectors such as side-loading via digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite. A Linux variant of the malware, version 2.1, observed in December 2025, was identified as the most recent version linked to the campaign. This Linux sample is capable of collecting extensive system information, spawning command shells, and allowing operators to manipulate files by uploading, downloading, and deleting them.

Lumen's telemetry identified approximately a dozen compromised enterprise entities, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website located in Lithuania. The majority of compromised servers were associated with the backend infrastructure of mobile applications. Additionally, the threat actor compromised a GitLab server in Hong Kong, which created a potential foothold for supply-chain attacks. The targeting patterns observed by Lumen were consistent with operations aligned with China, although the researchers were unable to attribute the activity to a specific threat actor or known activity cluster. Indicators of compromise (IoCs) related to this activity have been shared to assist defenders in detection and blocking efforts.