BambooToken malware controls Windows and Linux systems via MQTT

BambooToken exploits the MQTT protocol — commonly used for IoT messaging — as a covert command-and-control channel, allowing attackers to blend malicious traffic with legitimate business communications and avoid detection. By routing C2 traffic through MQTT brokers rather than direct attacker infrastructure, the malware gains resilience against traditional IP-based blocking and takedown efforts. Its cross-platform design targeting both Windows and Linux systems significantly broadens the attack surface, particularly for organizations in financial, legal, and software development sectors. This highlights the danger of permitting non-standard or poorly monitored protocols to traverse enterprise networks without inspection. Organizations that lack deep packet inspection and protocol-level monitoring are effectively blind to this class of threat.