Cybersecurity researchers have uncovered a multi-platform malware campaign that leverages an unconventional Internet of Things messaging protocol to remotely control Windows and Linux machines. The malware family, dubbed BambooToken, has been operational since at least February 2023 and has targeted organizations across Asia and South America, with infections detected as recently as July 2026, according to a report from Lumen Black Lotus Labs shared with The Hacker News. The campaign uses the Message Queueing Telemetry Transport (MQTT) protocol — a lightweight communication system typically used for IoT devices — as its command-and-control channel, enabling large-scale operations through an uncommon method that has helped the attackers evade detection.
The attackers exploit software from Tendyron, a Chinese manufacturer of hardware-based security tokens used in high-security environments to verify user identities for workstation access. Tendyron claims to have 190 million tokens in circulation and lists customers in China's financial and government sectors, among other industries. The malware operators use Tendyron's OnKey software to sideload malicious agents into targeted machines, according to the report, though neither Tendyron's code-signing certificate nor its build environment has been compromised. Most BambooToken samples uploaded to VirusTotal came from Chinese IP address space, suggesting a data collection campaign focused on users within China and neighboring countries. The malware has infected a dozen entities including mobile application servers, a GitLab server in Hong Kong, a Vietnamese company developing a portable lifestyle management device, a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania, and a Malaysian finance organization.
Early versions of BambooToken extracted command-and-control server information from a .DAT file or used a hard-coded fallback server, then gathered system details and transmitted them to the C2 server. Later iterations sideload a rogue DLL file used by the Tendyron OnKeySrv program to enumerate the host and establish a command loop using MQTT for communication. By December 2025, the malware expanded to target Linux hosts while maintaining its reliance on MQTT. "We assess that sideloading would likely trigger fewer EDR alerts, so as the campaign evolved so did that threat actors TTPs," Ryan English, information security engineer at Lumen Technologies Black Lotus Labs, told The Hacker News. The malware deploys an antivirus plugin for Windows that uses the Windows Management Instrumentation framework to collect details about installed antivirus products and send them to the C2 server.
The campaign's use of Cloudflare as a proxy for its infrastructure enabled significant reach — one domain associated with the 2025 campaign recently entered the top 500,000 domains on Cloudflare Radar, while an older domain ranked in the top 1 million at the peak of operations in 2024, indicating widespread infection. The operators appear to have taken inspiration from existing tactics: only a handful of campaigns have used MQTT for command-and-control to date, including MQsTTang (used by the Chinese nation-state group Mustang Panda beginning in January 2023), the Android malware Tizi, the malware loader WailingCrab, and the operational technology malware IOCONTROL. Both MQsTTang and BambooToken emerged around the same time in early 2023, though there's no evidence of overlap between the two threat activity clusters. The use of DLL sideloading combined with a SoftEther VPN connection from a Virtual Private Server to one of the C2 nodes suggests a China nexus, though the report states it's unknown who is behind the activity.
The targeting pattern supports extensive data collection with potential for broad surveillance capabilities, the report concludes. Mobile apps and smartwatches connected to cellular networks could enable pattern-of-life analysis, targeting financial organizations might expose transaction data, and attacking hospitality systems could reveal travel history and plans. The initial access vector used to deliver BambooToken remains undetermined, and researchers identified IP addresses geolocated to Singapore, Cambodia, and Vietnam — corresponding to MikroTik and DrayTek routers — communicating with one of the active C2 nodes. The combination of MQTT for controlling numerous clients from a central point and routing through Cloudflare enables large-scale operation through an unconventional communication method that has allowed a skilled threat actor to stay undetected until now. Organizations that deploy Tendyron security tokens face heightened risk from attackers who understand the software's vulnerabilities, and the campaign's geographic spread suggests adversaries are willing to invest in sustained operations across multiple continents to harvest intelligence at scale.