The banana stand: brokering and managing infections across Asia using MQTT

BambooToken is a multiplatform malware family active since at least February 2023 that uses the MQTT protocol for covert command and control. It targets Windows and Linux systems primarily across Asia and South America, infecting backend servers in various sectors including mobile apps, legal, financial, software, hotels, and GitLab instances. The malware employs sideloading via Tendyron's OnKey authentication software, common in Chinese banking and government networks. It has capabilities for host enumeration, antivirus detection, and potential keylogging and clipboard theft. The attacker uses MQTT's publish-subscribe model and Cloudflare proxies to conceal infrastructure and operations. The campaign demonstrates sophisticated operational security and widespread infections.

• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• CoolClient backdoor goes deeper: Windows kernel rootkit addedMalware2026-08-14
• Analysis of a Modular Cyber Espionage FrameworkMalware2026-08-07
• OctLurk and SilkLurk: new Backdoors in Central AsiaMalware2026-07-30
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09