New BambooToken Malware Hides Its Orders Inside IoT Messaging Traffic

Key points

• Lumen's Black Lotus Labs disclosed a previously unknown malware framework called BambooToken, active since at least 2023, that infects both Windows and Linux machines.
• Newer 2024 to 2025 versions route their orders through MQTT, a lightweight messaging system designed for IoT sensors, so infected computers never talk to the attacker directly.
• Roughly a dozen enterprise victims have been identified, including hotels, law firms, biomedical companies and a cryptocurrency site in Lithuania, concentrated in Asia and South America.
• The malware arrives by piggybacking on a legitimately signed Tendyron OnKey USB security-token installer, or by pretending to be the Kingsoft Office suite.
• Targeting patterns look consistent with China-aligned spying, but Lumen has not named a specific group.

There's a new backdoor doing the rounds, and the interesting bit isn't the payload. It's the postbox.

Lumen's Black Lotus Labs, the research team at the US telecoms carrier, has published details of a malware framework it calls BambooToken. The tool has been quietly active since 2023, and the newer builds from 2024 and 2025 have swapped the usual attacker-controlled web servers for something far stranger: MQTT, a messaging protocol designed for thermostats and factory sensors. Black Lotus Labs has form here; we covered their year-long mapping of a Chinese espionage infrastructure-for-hire operation on 26 August.

BleepingComputer first flagged the writeup.

What is BambooToken actually doing?

BambooToken is a remote-access backdoor, meaning software that lets an outsider quietly run commands on a computer they do not own. It works on both Windows and Linux servers. Once installed, it collects system information, can open a command shell, and can upload or delete files.

Black Lotus Labs also recovered a plugin that lists which antivirus products are running on the infected machine and reports back. Inside the code, researchers found leftover references to keylogging (recording what a user types), clipboard theft, audio capture and screenshots. That code was dormant, so it is not clear whether those features were ever used in real attacks or were still being built.

A newer Linux build, version 2.1, was seen as recently as December 2025 and still looks unfinished.

Why does MQTT matter here?

MQTT stands for Message Queuing Telemetry Transport. It is a small, efficient protocol built for Internet of Things devices: the sensors and smart gadgets that need to send short status messages without eating up bandwidth. Instead of two machines calling each other directly, everyone connects to a central broker, and messages flow through named channels called topics.

BambooToken uses that broker as a dead drop. The infected computer subscribes to a topic tied to its unique ID. Commands arrive via the attacker publishing to that topic; results go back the same way.

In practice, the victim's machine never opens a direct connection to attacker infrastructure. Network defenders looking for suspicious outbound traffic to a command server won't see one. They see a machine chatting to what looks like a normal IoT broker.

MQTT abuse is not brand new. ESET documented an unrelated backdoor called MQsTTang in 2023. It is still rare enough that most corporate monitoring tools do not treat it as suspicious by default, and that is the whole point.

How does it get onto the machine?

Two routes, according to Lumen. The first is DLL side-loading through a digitally signed installer for Tendyron OnKey, a USB security-token product used in China for online banking and government logins. A signed installer looks legitimate to Windows, so the malicious file loaded alongside it slips in quietly. The second is straightforward impersonation of Kingsoft Office, a popular productivity suite in the region.

Who has been hit?

Lumen suggests some activity may have targeted overseas Chinese users reaching mainland services through the SpeedCN VPN. The targeting fits a China-aligned espionage profile, but no group has been named.

Should you worry?

The story here is protocol choice, not novel code. Defenders who only watch HTTP and DNS traffic will miss this entirely. If your network allows outbound MQTT to arbitrary brokers and nobody is logging it, that's a blind spot a competent operator can drive a bus through. Check what is talking to MQTT ports on your network tonight.