Security researchers have uncovered a previously undocumented malware family, dubbed BambooToken, that leverages the Message Queueing Telemetry Transport (MQTT) protocol for command-and-control. MQTT is widely used in IoT and lightweight messaging, but its adoption here gives the malware a stealthy, bidirectional channel to issue instructions and exfiltrate data.
The campaign appears to be multi-platform, with samples observed affecting both Windows and Linux systems. By relying on a standard protocol that is often allowed through firewalls, BambooToken may evade traditional network defenses. Researchers have not yet linked the malware to a specific threat actor, and the full scope of the campaign remains under investigation.
The use of MQTT in malware is notable because it blends malicious traffic with legitimate IoT communications, making detection harder. As this is the sole source of information, no independent confirmation or differing details are available at this time.