GoKawiilBambooToken malware framework uses MQTT protocol to control Windows and Linux hosts
Researchers at Lumen's Black Lotus Labs identified a previously undocumented malware framework, BambooToken, active since 2023, that in its 2024-2025 variants switched to the MQTT messaging protocol for command-and-control. Infected systems subscribe to unique topics on a central broker to receive operator commands and report status, and the malware has infected servers tied to mobile apps, legal, financial, and software development firms via side-loading disguised as Tendyron OnKey USB-token software or a fake Kingsoft Office suite.