BambooToken malware controls Windows and Linux systems via MQTT

September 15, 2026 · BleepingComputer · Severity: HIGH

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.

Key Takeaways

BambooToken malware uses the MQTT protocol to establish command-and-control channels across both Windows and Linux systems, making detection more challenging.
The cross-platform malware leverages legitimate IoT messaging infrastructure to blend malicious traffic with normal MQTT communications on infected networks.
Security teams should monitor for anomalous MQTT traffic patterns and implement network segmentation for IoT communication channels.