Kiran 
A previously undocumented malware family called BambooToken has quietly infected Windows and Linux systems across Asia and South America since at least February 2023.
What sets this campaign apart isn’t just its stealth, but its choice of communication protocol: MQTT, a lightweight messaging system built for IoT devices, repurposed here to run command-and-control operations that hide an attacker’s real infrastructure behind a broker.
MQTT operates on a publish-subscribe model. Infected machines “subscribe” to topics and a central broker approves message delivery, meaning compromised hosts never talk directly to the actual C2 server.
BambooToken Malware Abuses MQTT Protocol
That architectural quirk gives attackers a layer of obfuscation rarely seen outside IoT malware. Black Lotus Labs notes only three prior campaigns have used this technique: the IoT malware IOCONTROL, the PlugX-linked backdoor Korplug, and the cybercrime tool WailingCrab.
BambooToken shows no direct code overlap with any of them, earning its classification as a distinct emerging cluster.
BambooToken’s Windows infections hinge on a hijack-execution-flow technique that abuses Tendyron’s “OnKey” USB token software, a NIST-registered cryptographic tool widely deployed across Chinese banks and government agencies.
The actors sideload a malicious DLL, OnKeyToken_KEB.dll, alongside the legitimate, validly signed OnKeySrv executable. Lumen was explicit that Tendyron’s code-signing certificate was not compromised; the binary was simply vulnerable to sideloading.
A separate variant masqueraded as Zhuhai Kingsoft Office software, using the same trust-subversion approach SpecterOps documented in 2022.
The malware’s evolution tells its own story. Version 1 (2023) used straightforward HTTP beaconing to hardcoded domains like chat5188[.]tk. By 2024–2025, version 2.0 shifted entirely to MQTT, subscribing to GUID-tagged topics for plugin delivery and removal.
By December 2025, a Linux variant (version 2.1) emerged with expanded host enumeration, SHELL and file-exfiltration handlers, and a heartbeat “ONLINE” beacon collecting BIOS, CPU, MAC address, and process data.
The only confirmed plugin identified so far scans installed antivirus products every five seconds and reports them back, likely to help the operators evade detection before deploying heavier tools.
Ironically, a missed compiler flag (/Gy) left dead code in the binaries, revealing string references to COM_clipboard and a misspelled “KEY_RECOURD,” strongly suggesting unimplemented keylogging and clipboard-hijacking modules, plus audio and webcam capture capability.
Combined with forged PE header timestamps designed to mimic a Windows Server 2003/Visual Studio 2005 build environment, the errors point to a disciplined but not infallible operator.
Lumen’s telemetry links BambooToken to at least a dozen enterprise victims, including mobile-app backends, a smartwatch software firm, a Vietnamese hotel, a Hong Kong GitLab instance, a Malaysian finance company, and a Chilean law firm.
A separate cluster of over 150 compromised MikroTik and DrayTek routers across Singapore, Cambodia, and Vietnam suggests parallel targeting of the Chinese diaspora through a VPN service called speedCN.
Lumen recommends mapping software supply chains and CI/CD dependencies, hardening router SNMP configurations, deploying EDR with lateral-movement monitoring, and adding firewall rules to flag anomalous MQTT traffic leaving the network, since MQTT rarely belongs on enterprise networks at all.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
