BambooToken malware controls Windows and Linux systems via MQTT
Recorded: Sept. 15, 2026, 3:27 p.m.
| Original | Summarized |
BambooToken malware controls Windows and Linux systems via MQTT News Featured Hackers hijack HBO Max Reddit account to push malware in ClickFix ads Homebrew 7.0.0 gets built-in GUI, better security controls Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent New Android malware encrypts files, steals data, and harasses victims BambooToken malware controls Windows and Linux systems via MQTT Hackers target WordPress sites via third-party WooCommerce plugin What Zero-Day Response Should Be in the Post-Mythos Era CISA: Critical VMware RCE flaw now exploited by ransomware gangs Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityBambooToken malware controls Windows and Linux systems via MQTT BambooToken malware controls Windows and Linux systems via MQTT By Bill Toulas September 15, 2026 A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. Hardcoded Topics in the malware codeSource: Lumen Strings found in dead code section of .rdata fileSource: Lumen Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Backdoor Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories Microsoft releases emergency Windows updates to fix RDS failures Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Microsoft: September updates cause RDS failures on Windows Server Sponsor Posts EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Patch automation needs more than speed. Action1 brings control into every stage of deployment. Watch a working exploit hit live controls and see exactly what blocks, detects, or misses Overdue a password health-check? Audit your Active Directory for free Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
A previously unknown malware framework named BambooToken has utilized the Message Queuing Telemetry Transport, or MQTT, protocol to establish command-and-control communications across both Windows and Linux systems. This malware framework became active in at least 2023 and evolved into variants between 2024 and 2025, compromising servers associated with mobile applications, legal and financial services, and software development entities. MQTT, being a lightweight messaging protocol designed primarily for Internet of Things devices, is leveraged by BambooToken through a publish-subscribe model, utilizing a central broker and topics to relay messages rather than relying on direct communication channels. The mechanism employed by BambooToken involves infected systems subscribing to specific topics identified by a unique marker. Attackers then publish commands to these topics, allowing the malware to execute instructions on the compromised hosts. Furthermore, the malware publishes status updates and system information to the broker while simultaneously receiving operator commands through subscribed topics. This method of communication provides advantages in evasion and resilience because the infected systems do not establish direct connections to the attacker's infrastructure, and the communication can be asynchronous, ensuring operational continuity during network disruptions. Research conducted by Black Lotus Labs, the research arm of Lumen, involved recovering a BambooToken plugin which was capable of enumerating antivirus products on infected hosts and reporting the results back to the command and control server. During this investigation, researchers also discovered strings within the dead code section of the .rdata file, which pointed to functionalities involving keylogging, clipboard theft, audio recording, webcam capturing, and screenshot capturing, although the existence and usage of these specific modules could not be definitively confirmed. The malware framework has been linked to infection vectors such as side-loading via digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite. A Linux variant of the malware, version 2.1, observed in December 2025, was identified as the most recent version linked to the campaign. This Linux sample is capable of collecting extensive system information, spawning command shells, and allowing operators to manipulate files by uploading, downloading, and deleting them. Lumen's telemetry identified approximately a dozen compromised enterprise entities, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website located in Lithuania. The majority of compromised servers were associated with the backend infrastructure of mobile applications. Additionally, the threat actor compromised a GitLab server in Hong Kong, which created a potential foothold for supply-chain attacks. The targeting patterns observed by Lumen were consistent with operations aligned with China, although the researchers were unable to attribute the activity to a specific threat actor or known activity cluster. Indicators of compromise (IoCs) related to this activity have been shared to assist defenders in detection and blocking efforts. |