BambooToken is a previously unknown malware framework that uses the MQTT protocol for command-and-control communications on infected Windows and Linux systems. The malware subscribes to MQTT topics linked to unique identifiers to receive commands and publishes system status back to the attacker via a central MQTT broker. This indirect communication method improves evasion and operational continuity. Infection methods include side-loading through digitally signed Tendyron OnKey USB-token software and impersonation of Kingsoft Office. The malware can enumerate antivirus products and potentially includes modules for keylogging, clipboard theft, audio and webcam recording, and screenshot capture, though these modules were found in dead code and may not be active. The Linux variant observed in late 2025 supports command shell spawning and file operations but appears under development. Lumen's telemetry identified about a dozen compromised enterprises, mainly in Asia and South America, including mobile app backend servers and a GitLab server, raising supply-chain attack concerns. The threat actor remains unattributed but shows targeting consistent with China-aligned groups.

BambooToken compromises enterprise Windows and Linux systems, enabling attackers to execute arbitrary commands, collect system information, and potentially perform espionage activities such as keylogging, clipboard theft, audio and webcam recording, and screenshot capture. The use of MQTT for C2 communications enhances stealth and resilience, complicating detection and mitigation. Compromise of backend infrastructure for mobile apps and a GitLab server introduces risks of supply-chain attacks. The infection of entities in diverse sectors including legal, financial, biomedical, and cryptocurrency increases the potential impact on sensitive data and operations.

No official patch or remediation guidance is provided for BambooToken malware. Mitigation should focus on detecting and blocking MQTT-based command-and-control traffic and monitoring for indicators of compromise shared by Lumen. Organizations should verify the integrity of software installations to prevent side-loading attacks, especially involving digitally signed USB-token software and impersonated productivity suites. Since the malware uses MQTT brokers for communication, restricting or monitoring MQTT traffic in enterprise networks may help reduce exposure. Incident response teams should apply IoCs from Lumen to identify and contain infections. Patch status is not yet confirmed — check vendor advisories and threat intelligence updates for current remediation guidance.