Cybersecurity teams have discovered a new threatscape: a cross-platform malware dubbed BambooToken, using the Message Queue Telemetry Transport (MQTT) protocol to compromise Windows and Linux systems. Active since at least February 2023, it’s recently been observed targeting institutions in Asia and South America, with fresh activity logged as recently as July 2026.
How BambooToken Operates
BambooToken relies on exploiting Tendyron’s OnKey hardware token software to sneak its malicious agents into machines—most likely through DLL sideloading vulnerabilities. These OnKey tokens are PKI USB devices used for authentication, widely deployed in high-security sectors like finance and government in China. The adversary appears to use a vulnerable binary present on target systems to load a rogue DLL (OnKeyToken_KEB.dll), which sets up a command loop leveraging MQTT for remote control.
Initial versions pull the command-and-control (C2) endpoint from a .DAT file, or revert to a hardcoded address if unavailable. They start by harvesting system details, sending them back to C2 servers such as chat5188[.]tk, and awaiting commands to load plugins, halt operations, or shut down entirely. Later samples have added Linux compatibility and expanded espionage features, including an antivirus probe using Windows Management Instrumentation (WMI) to identify installed AV software and transmit results to api80.c2iznja[.]com via MQTT.
Targets, Infrastructure, and Global Footprint
This campaign seems well-resourced and deeply stealthy. Many BambooToken samples were uploaded from Chinese IPs. Communications involving C2 nodes have been traced to routers in Singapore, Cambodia, and Vietnam. Victims include diverse entities: a Hong Kong GitLab instance, a Vietnamese lifestyle device developer, a hotel in Vietnam, a biomed company in Argentina, legal and finance organizations in Chile and Malaysia, and a cryptocurrency website based in Lithuania.
The infrastructure further uses Cloudflare as a proxy, helping obscure locations of key domains. One domain tied to recent operations entered the top 500,000 rankings on Cloudflare Radar in 2025—putting it among the more visible domains—while older domains had reached the top one million during earlier campaigns.
Implications and Speculation
Though there’s no confirmed attribution, evidence suggests links to a China-based threat actor. VPN connections via SoftEther from virtual private servers to C2 networks, combined with the heavy use of Tendyron hardware tokens in China, point toward that region.
The use of MQTT—a protocol common in IoT environments—for remote control is notable. While some campaigns have employed MQTT before, including Mustang Panda’s MQsTTang backdoor and Android malware like Tizi, BambooToken’s scale and multi-platform reach mark an evolution in malware strategy. The targeting of mobile apps, financial institutions, hospitality, and legal sectors suggests intelligence gathering across transaction, personal, and travel-related data.
What to Watch For: Organizations using Tendyron devices should audit their OnKey software installations for DLL sideloading vulnerabilities. Monitoring network traffic for MQTT communications to unusual endpoints could help spot early signs of infection. Cross-border visibility is crucial, especially for companies in Asia and South America.
This emerging threat underscores how adversaries are innovating—blending hardware token abuse, crossOS reach, and IoT-style protocols to evade detection. As BambooToken grows stealthier and its infrastructure more resilient, defenders need both technical vigilance and threat-hunting capabilities. The next few months will likely reveal more on its origins, full list of targets, and perhaps clues to the identities behind it.
