Researchers have identified a previously unknown malicious framework called BambooToken, believed to have been active since 2023 and targeting Windows and Linux systems. Versions developed between 2024 and 2025 use the Message Queuing Telemetry Transport protocol, commonly abbreviated as MQTT, to manage communications between infected devices and the attackers’ infrastructure.
The activity appeared on servers associated with mobile applications, as well as legal and financial services and software development environments. Measurements by Lumen, through its research arm Black Lotus Labs, identified approximately twelve compromised organizations, most of them in Asia and South America. The cases included hotels, biomedical companies, law firms, a financial institution, and a cryptocurrency website in Lithuania, along with a GitLab server in Hong Kong that could provide a foothold for supply-chain attacks.
How Does BambooToken Use the MQTT Protocol?
MQTT was originally designed as a lightweight protocol for exchanging messages in Internet of Things environments. Rather than using a direct connection between the device and the controlling party, the protocol relies on a central broker and channels called “topics,” to which clients subscribe and through which they exchange messages.
In the case of BambooToken, the infected device subscribes to topics associated with a unique identifier, and the attacker then publishes commands through those topics. In the opposite direction, the malware sends system status and information to the broker. This design makes it more difficult to directly link the infected device to the attacker’s infrastructure, while also allowing commands to continue being exchanged asynchronously when temporary network outages occur.
Infection Methods and Observed Capabilities
Black Lotus Labs said the infection occurred through the side-loading of a digitally signed executable belonging to Tendyron OnKey, a program for USB keys, or through the impersonation of the Kingsoft Office suite. The researchers recovered a component that scans the device for antivirus products and sends its findings to the command-and-control server.
They also found textual indicators associated with keylogging, clipboard-content theft, audio recording, webcam image capture, and screenshots. However, these indicators were contained in “dead code,” so the researchers cannot confirm whether these modules were actually used in offensive operations or were merely under development.
The latest Linux sample associated with the campaign carries version 2.1 and was observed in December 2025. It also uses MQTT, collects a broad range of system information, and can execute a command shell and upload, download, and delete files. Nevertheless, Black Lotus Labs described this sample as still appearing to be under development.
Why Does This Matter?
The significance of BambooToken does not lie in its use of MQTT itself—the protocol is well known and not new to the security landscape—but rather in its use of a channel common in connected environments to reduce the visibility of traditional command-and-control communications. This broadens what defense teams should review when analyzing MQTT traffic, especially on application servers and infrastructure where the protocol is not expected to be used.
The source of the campaign remains undetermined, as the researchers did not attribute the activity to a specific actor or known group. According to the report, the targeting patterns are consistent with operations linked to China. Lumen also hypothesized that some of the activity may have targeted Chinese users abroad who access services inside the mainland through SpeedCN VPN, but this remains a hypothesis rather than a definitive attribution. Lumen shared indicators of compromise to help defenders detect and block the activity.