BambooToken malware controls Windows and Linux systems via MQTT

As cited

Copy frozen at 2026-09-15 16:40 UTC (site build).

threat intel

BambooToken malware controls Windows and Linux systems via MQTT

BambooToken, a previously unknown malware framework active since at least 2023, uses the Message Queuing Telemetry Transport (MQTT) protocol to communicate with and control both Windows and Linux systems. The discovery reveals the actor's infrastructure capabilities and cross-platform targeting approach.

Why it matters: Defenders managing Windows and Linux endpoints should monitor for MQTT-based command and control traffic and assess whether BambooToken has compromised their infrastructure, as the malware's long operational period suggests undetected deployments may exist.

Source published

2026-09-15 15:00 UTC

First seen by Cybersecurity Tracker

2026-09-15 15:52 UTC