BambooToken Malware Exploits MQTT to Command Windows and Linux Systems

BambooToken is a newly surfaced malware framework that has been active since at least 2023. In the past year, the actors behind it have shifted their command‑and‑control (C2) strategy to use the lightweight Message Queuing Telemetry Transport (MQTT) protocol, a protocol traditionally reserved for IoT devices.

Why MQTT? Evasion & Resilience

MQTT operates through a central broker and a publish/subscribe model, meaning infected machines do not reach out directly to the attacker’s servers. This indirect path makes it harder for defenders to trace traffic and adds a degree of resilience: if a network hiccups, the broker can queue commands until the host reconnects.

Infection Vectors & Capabilities

• Side‑loading via a digitally signed Tendyron OnKey USB‑token application.
• Impersonating the Kingsoft Office productivity suite to trick users into installing the payload.
• Enumerating installed antivirus products and returning the data to the broker.
• Dead‑code strings referencing keylogging, clipboard theft, audio recording, webcam capture, and screenshot capture.
• Full system information gathering.
• Ability to spawn a command shell, upload, download, and delete files.

Linux Variant 2.1

The most recent sample, observed in December 2025, is a Linux version that also uses MQTT. While it can perform the same core functions as the Windows build, analysts believe the code is still under development.

Victim Profile

Black Lotus Labs’ telemetry linked BambooToken to roughly a dozen compromised enterprises, primarily in Asia and South America. Victims included hotels, biomedical firms, law firms, a financial organization, and a Lithuanian cryptocurrency website. The attackers also targeted the backend servers of mobile applications and even compromised a GitLab server in Hong Kong, creating a potential supply‑chain foothold.

“The use of MQTT gives the threat actors a stealthy, asynchronous communication channel that is not typical for malware,” said a researcher at Lumen.

Attribution Status

So far, no specific threat actor or known activity cluster has been tied to BambooToken. Analysts suspect the campaign may be aimed at overseas Chinese users accessing mainland services through the SpeedCN VPN service, but definitive attribution remains elusive.