Researchers at Lumen’s Black Lotus Labs have detailed BambooToken, a malware framework active since at least 2023 that routes its command-and-control traffic through MQTT — the lightweight messaging protocol normally used to connect IoT sensors and smart devices. Using MQTT means infected machines never dial directly back to the attacker’s server; instead they subscribe to topics on a shared broker, and the attacker publishes commands to those topics. This makes the traffic harder to flag because MQTT traffic looks like routine IoT telemetry rather than traditional malware callbacks, and it keeps the attacker’s real infrastructure a layer removed from the victim.
The malware has been distributed by side-loading through a digitally signed Tendyron OnKey USB-token software package and by impersonating the Kingsoft Office productivity suite. Lumen identified about a dozen compromised enterprise organizations, mostly in Asia and South America, spanning hotels, biomedical firms, law firms, a financial institution, and a cryptocurrency company in Lithuania. A Windows variant has been in operation for years; a Linux variant (version 2.1, observed December 2025) that also uses MQTT and adds remote shell access appeared more recently, though researchers assess it was still under active development at the time. The Windows variants include a plugin that enumerates installed antivirus products and reports them back to the attacker. Code strings point to keylogging, clipboard theft, audio recording, and webcam capture capabilities, though Lumen found those in dead code sections and cannot confirm whether those modules were deployed in actual attacks.