BambooToken Malware Exploits MQTT to Command Windows and Linux Systems

A newly uncovered malware framework dubbed BambooToken has been observed leveraging the lightweight Message Queuing Telemetry Transport (MQTT) protocol to issue commands to compromised Windows and Linux machines, researchers reported.

The code appears to have been active since at least 2023, though it escaped detection until recent analysis revealed its use of MQTT for command‑and‑control (C2) traffic. Unlike many traditional threats that rely on HTTP or DNS channels, BambooToken’s choice of MQTT allows it to blend in with legitimate IoT and telemetry communications.

MQTT is commonly employed in industrial automation, smart‑home devices, and cloud‑based monitoring because of its low bandwidth footprint and publish‑subscribe architecture. Security experts note that the protocol’s design—where clients subscribe to topics and receive messages without a direct request—makes it attractive for malicious actors seeking stealthy, asynchronous control over infected hosts.

Technical examinations show that BambooToken can run on both Windows and Linux platforms, receiving instructions such as file manipulation, credential harvesting, and lateral movement commands through MQTT topics. Its cross‑platform nature broadens the potential impact, enabling attackers to target a wide range of environments from corporate servers to edge devices.

The findings were first highlighted by BleepingComputer, which cited early samples and network traces that demonstrated the malware’s MQTT traffic patterns. Subsequent analysis by independent security labs confirmed the framework’s modular design and its ability to persist by installing services that automatically reconnect to the malicious broker.

Defenders are advised to monitor MQTT broker logs for anomalous topic subscriptions, enforce strict authentication on MQTT endpoints, and apply network segmentation to isolate IoT traffic from critical systems. As researchers continue to dissect BambooToken, updates to detection signatures and threat‑intel feeds are expected, underscoring the need for organizations to stay vigilant against novel C2 mechanisms.