BambooToken Malware Exploits MQTT for Control of Infected Systems

• •BambooToken malware uses MQTT for stealthy control of infected systems.
• •Active since February 2023, targeting sectors in Asia and South America.
• •Sideloading via Tendyron's OnKey software is a primary infection vector.

The BambooToken malware, discovered by Lumen's Black Lotus Labs, has been active since at least February 2023, targeting Windows and Linux systems across Asia and South America. It uses the MQTT protocol for command-and-control communications, allowing stealthy operations and evasion of detection. The malware was delivered by sideloading through Tendyron's OnKey USB token software, which is widely used in high-security environments. The campaign has infected various sectors, including mobile applications, legal services, and financial institutions. Recent telemetry indicates ongoing activity as of July 2026, with multiple compromised servers identified. Researchers found that the malware can perform extensive surveillance, including keylogging and audio recording, although some capabilities appear to be in development. The threat actor remains unidentified, but the targeting patterns suggest possible links to China-aligned operations. Organizations are urged to enhance their defenses against this emerging threat.