GoKawiilBambooToken malware framework uses MQTT protocol to control Windows and Linux hosts
Researchers at Lumen's Black Lotus Labs identified a previously undocumented malware framework, BambooToken, active since 2023, that in its 2024-2025 variants switched to the MQTT messaging protocol for command-and-control. Infected systems subscribe to unique topics on a central broker to receive operator commands and report status, and the malware has infected servers tied to mobile apps, legal, financial, and software development firms via side-loading disguised as Tendyron OnKey USB-token software or a fake Kingsoft Office suite.
GoKawiil's interpretation of the reporting above, not reported fact.
Using MQTT, a protocol built for IoT devices rather than traditional malware, lets infected machines avoid direct connections to attacker servers, making detection harder and keeping the malware operational even through network interruptions. The framework's capabilities—keylogging, clipboard and webcam capture, antivirus enumeration—suggest it's built for sustained espionage against enterprise targets, and its novel protocol choice could inspire other threat actors to adopt similar evasion techniques.
- BambooToken is a newly documented malware framework active since 2023 targeting Windows and Linux systems.
- It repurposes MQTT, an IoT messaging protocol, for stealthy asynchronous command-and-control communication.
- Infection methods include impersonating Kingsoft Office and side-loading via signed Tendyron OnKey USB-token software, with capabilities like keylogging and webcam capture.
YubiKey 5C NFC Security Key — With malware frameworks like BambooToken quietly hijacking command-and-control channels, hardening endpoint and account security is more important than ever. A hardware security key like the YubiKey adds a strong layer of authentication that helps prevent unauthorized access even if credentials get compromised. It's a simple, practical step toward better protecting the servers and accounts targeted by this kind of attack.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-15
Published there as: “BambooToken malware controls Windows and Linux systems via MQTT”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.