BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems.

The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America. Activity linked to the malware has been detected as recently as July 2026.

Lumen Black Lotus Labs said it discovered the previously undocumented malware on VirusTotal in early 2026, with evidence pointing to a skilled threat actor that has managed to stay undetected until now.

“The actor used Tendyron’s ‘OnKey’ software to sideload agents into targeted machines,” Black Lotus Labs said in a report shared with The Hacker News. “Tendyron creates hardware-based tokens employed in high-security settings to verify user identities for workstation access. Their website lists customers in China’s financial and government sectors, among other verticals”

Tendyron OnKey is a second-generation Public Key Infrastructure (PKI) USB security token and authentication device designed to protect online banking and financial transactions. On its website, Tendyron claims to have 190 million tokens in circulation.

Although neither Tendyron’s code-signing certificate nor its build environment has been compromised in connection with the activity, it’s suspected that the operators are relying on binary that’s vulnerable to DLL sideloading to trigger the attack within targeted networks that are likely to have the program installed.

In addition, most of the BambooToken samples have been uploaded to the VirusTotal platform from the Chinese IP address space, indicating a data collection campaign targeting users within and other neighboring countries.

The use of MQTT, a lightweight, publish-subscribe network protocol, for remote command-and-control (C2) is not a new phenomenon. As far back as January 2023, the Chinese nation-state hacking group known as Mustang Panda was observed using a backdoor called MQsTTang that used the IoT messaging protocol to fetch and execute commands on compromised hosts.

Besides MQsTTang, there have been only a handful of campaigns that have used MQTT to date –

• An Android malware called Tizi that can harvest sensitive data from various messaging and social media apps, as well as use HTTPS or MQTT for C2 to realize its goals.
• A malware loader called WailingCrab (aka WikiLoader) that’s distributed via delivery- and shipping-themed email messages. It’s attributed to a cybercrime group called Bamboo Spider.
• An operational technology (OT) malware called IOCONTROL (aka OrpaCrab) that has targeted IoT and SCADA systems in Israel and the U.S.

Early iterations of the BambooToken agent work by extracting the C2 server from a .DAT file, or falling back to a hard-coded server if the file is not found. Once this step is complete, the malware proceeds to gather system details and transmit them to the C2 server (“chat5188[.]tk”). In response, the server issues commands to load a plugin, stop all plugins, terminate the execution of the malware, and disconnect from the C2 server.

Subsequent versions of the malware sideload a rogue version of a DLL (“OnKeyToken_KEB.dll”) used by the Tendyron OnKeySrv program to enumerate the host and enter into a command loop that uses MQTT for C2. As of December 2025, BambooToken has expanded in scope to also target Linux hosts while still relying on MQTT.

BambooToken is equipped to collect extensive host information and deliver an antivirus plugin for Windows that uses the Windows Management Instrumentation (WMI) framework to gather details about installed antivirus products on the machine and exfiltrate them to the C2 server (“api80.c2iznja[.]com”).