Bamboo Token Malware Uses MQTT to Control Windows and Linux Systems
Summary: Lumen Black Lotus Labs disclosed BambooToken, a malware family active since at least February 2023 that uses the MQTT protocol as a command-and-control channel to control Windows and Linux systems, with activity detected as recently as July 2026 and Linux targeting added by December 2025. The malware is delivered by sideloading a rogue DLL ("OnKeyToken_KEB.dll") through Tendyron's signed OnKey software, and most samples were uploaded to VirusTotal from Chinese IP address space.
Bottom line: A dozen compromised entities have been detected across Asia and South America, including a GitLab server in Hong Kong, a Malaysian finance organization, and a cryptocurrency website in Lithuania, and Lumen assesses the targeting supports extensive data collection for pattern-of-life analysis. The operators abuse a legitimate signed security token binary rather than compromising its certificate, which is why sideloading likely triggers fewer EDR alerts.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026