BambooToken Malware Harnesses MQTT to Command Windows and Linux Infections

Cybersecurity analysts have identified a new cross‑platform malware family, dubbed BambooToken, that exploits the Message Queue Telemetry Transport (MQTT) protocol to issue commands to compromised Windows and Linux computers. The discovery marks one of the first documented instances of MQTT being repurposed as a covert command‑and‑control (C2) channel in a broad‑scale campaign.

MQTT, originally designed for lightweight communication among Internet of Things (IoT) devices, operates on a publish‑subscribe model that allows a central broker to relay messages to subscribed clients. Its minimal overhead and widespread adoption in industrial and consumer devices make it an attractive target for threat actors seeking a stealthy conduit that blends in with legitimate traffic.

Researchers observed that BambooToken implants establish connections to publicly accessible MQTT brokers, where they subscribe to topic strings that encode operational instructions. Once a system is infected, the malware can receive payloads, execute arbitrary commands, and exfiltrate data without relying on traditional HTTP or DNS‑based channels. The codebase includes modules for both Windows and Linux, enabling the same campaign to compromise heterogeneous networks with a single toolset.

The emergence of a multi‑platform payload that leverages MQTT raises concerns for enterprises that run mixed‑OS environments and IoT infrastructure. Because MQTT traffic is often permitted through firewalls for legitimate device management, the malware can evade conventional perimeter defenses. Security firms have classified BambooToken as a significant threat, noting its potential to facilitate lateral movement, ransomware deployment, or espionage activities once a foothold is gained.

Defenders are advised to monitor MQTT broker logs for anomalous subscription patterns, enforce strict authentication on broker endpoints, and deploy network‑level anomaly detection that flags unusual publish‑subscribe activity. Ongoing analysis aims to map the full extent of the campaign, identify additional broker hosts, and develop signatures for endpoint protection platforms. As the threat landscape continues to adapt existing protocols for malicious purposes, vigilance around seemingly benign communication channels remains essential.