Malware Taps MQTT to Run Windows, Linux Bots

Security researchers at Lumen's Black Lotus Labs have pulled back the curtain on a multi-platform malware family that turns a lightweight IoT messaging protocol into a remote control channel for both Windows and Linux systems. The malware, tracked as BambooToken, is assessed to be active since at least February 2023, according to a report the research team shared with The Hacker News, with activity tied to the campaign detected as recently as July 2026.

The operation has quietly targeted organizations across Asia and South America, according to the report, and its use of a publish-subscribe messaging standard more commonly found in smart-home and industrial deployments sets it apart from the usual HTTP-based command-and-control traffic that endpoint tools are built to flag.

Finding BambooToken on VirusTotal

Black Lotus Labs said it discovered the previously undocumented malware on VirusTotal in early 2026. Evidence reviewed by the team points to a skilled threat actor that has managed to stay undetected until now, the researchers added. The report states the initial access vector used to deliver BambooToken remains undetermined.

Most of the BambooToken samples uploaded to VirusTotal originated from Chinese IP address space, according to the report, which the researchers described as indicating a data collection campaign targeting users within China and neighboring countries.

The attribution picture is incomplete. The report notes it is unknown who is behind the activity, but cites two factors — the use of DLL sideloading and a SoftEther VPN connection originating from a Virtual Private Server to one of the command nodes — as suggesting a China nexus.

How a Signed Banking Token Fits In

The delivery chain described in the report leans on a legitimate, signed piece of software rather than a weaponized document or exploit. Black Lotus Labs said the operator used Tendyron's "OnKey" software to sideload agents into targeted machines.

The actor used Tendyron's 'OnKey' software to sideload agents into targeted machines. Tendyron creates hardware-based tokens employed in high-security settings to verify user identities for workstation access. Their website lists customers in China's financial and government sectors, among other verticals

— Lumen Black Lotus Labs, in a report shared with The Hacker News

Tendyron OnKey is a second-generation Public Key Infrastructure (PKI) USB security token and authentication device designed to protect online banking and financial transactions. On its website, Tendyron claims to have 190 million tokens in circulation.

The report states that neither Tendyron's code-signing certificate nor its build environment was compromised in connection with the activity. Instead, it is suspected that the operators are relying on a binary vulnerable to DLL sideloading to trigger the attack within targeted networks where the program is likely to already be installed.

From PowerShell Stager to Sideloaded DLL

The mechanics of early BambooToken agents are described in the report. The first iterations extract the command-and-control server from a .DAT file, or fall back to a hard-coded server if that file is not found. Once that step is complete, the malware gathers system details and transmits them to the command server at chat5188[.]tk. In response, the server issues commands to load a plugin, stop all plugins, terminate the malware's execution, and disconnect from the server.

Subsequent versions of the malware sideload a rogue version of a DLL named OnKeyToken_KEB.dll, used by the Tendyron OnKeySrv program, to enumerate the host and enter a command loop that relies on MQTT for command-and-control. As of December 2025, BambooToken has expanded in scope to also target Linux hosts while still relying on MQTT.

Ryan English, information security engineer at Lumen Technologies Black Lotus Labs, described the earliest delivery step to The Hacker News.

The first version of BambooToken was initiated via a PowerShell script. The PowerShell script would act as a 'stager' by allocating memory and then running the malicious file. We assess that sideloading would likely trigger fewer EDR alerts, so as the campaign evolved so did that threat actors TTPs.

— Ryan English, information security engineer at Lumen Technologies Black Lotus Labs

What the Agent Collects From Hosts

According to the report, BambooToken is equipped to collect extensive host information and to deliver an antivirus plugin for Windows that uses the Windows Management Instrumentation (WMI) framework. That plugin gathers details about installed antivirus products on the machine and exfiltrates them to a second command server at api80.c2iznja[.]com.

The report also describes how the infrastructure was hidden. Both domains used Cloudflare as a proxy, according to Black Lotus Labs. One domain associated with the 2025 campaign recently entered the top 500,000 domains on Cloudflare Radar, while the older domain ranked in the top 1 million at the peak of operations in 2024 — which the report describes as indicating widespread infection across campaigns for this activity cluster.

The Targets: Apps, Servers, and Hotels

The victims identified in the report span several sectors and countries. Black Lotus Labs said it found IP addresses geolocated to Singapore, Cambodia, and Vietnam communicating with one of the active command nodes; those addresses correspond to MikroTik and DrayTek routers. A dozen compromised entities were detected in Asia and South America.

The vast majority of compromised servers are associated with mobile applications, according to the report. The list also includes a GitLab server in Hong Kong, a Vietnamese company developing a portable lifestyle management device, a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania, and a Malaysian finance organization.

MQTT itself is a lightweight, publish-subscribe network protocol, and using it for remote command-and-control is not a new phenomenon. The report notes that as far back as January 2023, the Chinese nation-state hacking group known as Mustang Panda was observed using a backdoor called MQsTTang that used the IoT messaging protocol to fetch and execute commands on compromised hosts.

Beyond MQsTTang, only a handful of campaigns have used MQTT to date. They include an Android malware called Tizi that can harvest sensitive data from various messaging and social media apps and use HTTPS or MQTT for command-and-control; a malware loader called WailingCrab (also known as WikiLoader) distributed through delivery- and shipping-themed email messages and attributed to a cybercrime group called Bamboo Spider; and an operational technology malware called IOCONTROL (also known as OrpaCrab) that has targeted IoT and SCADA systems in Israel and the U.S.

A Parallel With Mustang Panda's Playbook

One detail the report flags is timing: both MQsTTang and BambooToken emerged around the same time in early 2023. While there is no evidence of any overlap between the two threat activity clusters, Lumen said it is possible the threat actor could have taken a leaf out of the Mustang Panda playbook to update its own malware to support MQTT in upcoming versions.

The underlying design is what makes the approach notable, according to the researchers' summary of the campaign.

Using MQTT to control numerous clients from a central point, combined with routing via Cloudflare, enables large-scale operation through an unconventional communication method.

— Lumen Black Lotus Labs, in a report shared with The Hacker News

The report also states what the team believes the targeting pattern is designed to achieve.

We believe this campaign's targeting supports extensive data collection. Mobile apps and smartwatches connected to cellular networks could enable pattern-of-life analysis; targeting financial organizations might expose transaction data, and attacking hospitality systems could reveal travel history and plans.

— Lumen Black Lotus Labs, in a report shared with The Hacker News

The Numbers Behind the Campaign

• Active since at least February 2023, with activity detected as recently as July 2026
• Malware discovered on VirusTotal in early 2026
• Scope expanded to Linux hosts as of December 2025
• 190 million Tendyron tokens claimed in circulation on the vendor's website
• A dozen compromised entities detected in Asia and South America
• One 2025 campaign domain recently entered the top 500,000 domains on Cloudflare Radar; the older domain ranked in the top 1 million at its 2024 peak
• MQsTTang's MQTT backdoor was observed as far back as January 2023

Why This Matters for Defenders

The reporting describes a campaign that has been running for years without a confirmed initial access vector, which means organizations in the affected regions and sectors have little visibility into how BambooToken arrives in the first place. The report states Lumen discovered the previously undocumented malware on VirusTotal in early 2026 — not that it went undetected on the platform before then — so the timeline of its public exposure is separate from the campaign's long assessed lifespan.

For defenders, the most concrete takeaway from the report is the delivery chain's dependence on a signed, third-party authentication product. Because the report states neither Tendyron's certificate nor its build environment was compromised, and instead suspects the operators exploited a binary vulnerable to DLL sideloading, the risk surface is tied to installations of that software rather than to a stolen signing key. That distinction is worth noting for anyone evaluating their own exposure: the abuse described in the report rides on a legitimate, signed component that security tools may treat as trusted.

The infrastructure choices described in the report also mean that the campaign's command traffic has historically blended into ordinary Cloudflare-hosted web activity. Black Lotus Labs' own conclusion describes the approach as enabling large-scale operation through an unconventional communication method, which suggests visibility into this activity cluster may depend on more than standard domain blocklists, though the report does not offer specific detection guidance.

What remains unresolved in the reporting is the identity of the operator. The China nexus assessment rests on the tooling and VPN infrastructure observed, not on a formal attribution. Until that is corroborated, the campaign's scale — a dozen confirmed victims across two continents, a long assessed runtime, and a targeting set that spans mobile apps, finance, hospitality, and legal services — stands as the report's most solid ground. For organizations in those sectors, the practical question the reporting raises is whether a signed authentication tool they trust could serve as the vehicle for an intrusion they never see arrive.