BambooToken malware controls Windows and Linux systems via MQTT

BambooToken is a previously unknown malware framework that has been active since at least 2023. It targets both Windows and Linux systems, using the Message Queuing Telemetry Transport (MQTT) protocol as its command-and-control communication channel. MQTT is typically used in IoT environments, making this an unconventional choice that may help evade traditional network detection tools. The malware represents a cross-platform threat capable of compromising a wide range of enterprise and server environments. Its use of a lightweight messaging protocol suggests the authors are attempting to blend malicious traffic with legitimate IoT or industrial communications. The framework's capabilities and full infection chain are still being investigated, but its dual-OS targeting and protocol abuse make it a notable and potentially high-impact threat.