BambooToken Malware Exploits MQTT to Command Windows and Linux Machines

Cybersecurity analysts have uncovered a new cross‑platform malware campaign that leverages the lightweight Message Queue Telemetry Transport (MQTT) protocol to issue commands to compromised Windows and Linux hosts. The threat, identified by researchers and dubbed BambooToken, represents an emerging family of malicious software that repurposes a protocol commonly used for Internet of Things (IoT) messaging as a covert control channel.

The investigation reveals that BambooToken embeds an MQTT client within its payload, allowing the malicious code to subscribe to topics hosted on external brokers. By doing so, attackers can push instructions, retrieve stolen data, or trigger additional payloads without relying on traditional command‑and‑control (C2) infrastructures that are more likely to be flagged by network defenses.

Experts note that the choice of MQTT is significant because the protocol operates over standard TCP ports and often passes through firewalls that are configured to permit IoT traffic. This stealthy approach makes detection harder for organizations that monitor only well‑known C2 protocols such as HTTP or DNS. Moreover, the malware’s ability to run on both Windows and Linux expands its reach, potentially affecting a wide range of enterprise environments, from servers to workstations.

While the full scope of the campaign remains under assessment, preliminary analysis suggests that the malware can download supplementary modules, execute system commands, and exfiltrate files using the same MQTT channel. Security teams are advised to scrutinize outbound MQTT connections, especially those directed at unfamiliar broker endpoints, and to consider applying network‑level restrictions or deep‑packet inspection for MQTT traffic.

Researchers recommend that organizations update their intrusion‑detection signatures to include patterns associated with BambooToken’s MQTT usage and that they maintain regular patching cycles for both Windows and Linux systems. As the threat landscape continues to evolve, the emergence of MQTT‑based malware underscores the need for broader visibility into non‑traditional communication protocols that attackers may co‑opt for malicious purposes.