Cyber Blog

A previously unknown type of malware called BambooToken has been discovered targeting computers and organizations in Asia and South America. Security researchers say the malware has been active since at least 2023 and was still being used as recently as July 2026. What makes BambooToken particularly interesting is the unusual way it communicates with the people controlling it, allowing attackers to remotely send instructions to infected Windows and Linux computers.

Malware is simply a general term for harmful software designed to secretly get into a computer and perform unwanted actions. Depending on its purpose, malware can steal information, spy on users, damage systems, or give criminals remote access. BambooToken appears to be designed primarily for gathering information from infected computers and allowing attackers to control what the malware does.

Researchers at Lumen Technologies’ Black Lotus Labs discovered BambooToken while examining suspicious files uploaded to VirusTotal, a service commonly used by security researchers to check potentially dangerous files. The discovery revealed a campaign that had apparently remained largely unnoticed for several years.

One of the most unusual parts of BambooToken is the way it communicates with its operators. Instead of using a more traditional method, the malware uses something called MQTT. For someone who isn’t familiar with cybersecurity, MQTT can be thought of as a messaging system that allows devices or computers to send messages to one another through a central service.

MQTT itself is not malicious. It is a legitimate technology commonly used by smart devices and other connected equipment. For example, devices in a smart home can use similar messaging systems to communicate with a central server. BambooToken’s creators appear to be taking advantage of that normal technology to make their malicious communications less obvious.

Once BambooToken gets onto a computer, it can collect information about the machine and send that information back to the attackers. The malware can also receive instructions from its operators. Those instructions can tell it to download additional components, stop certain activities, shut itself down, or disconnect from the attackers’ system.

Think of it like someone secretly installing a small remote-control program on a computer. The program regularly checks in with the person controlling it and waits for instructions. The difference is that BambooToken hides those communications inside a messaging system that can also be used for legitimate purposes.

Researchers found that early versions of BambooToken used a PowerShell script to help start the malware. PowerShell is a legitimate Windows tool that administrators use to automate tasks and manage computers. Unfortunately, criminals can also abuse legitimate tools, making it more difficult for security software to distinguish between normal activity and malicious behavior.

Later versions of BambooToken changed the way they entered a computer. Instead of directly running the malware, the attackers appear to have taken advantage of a weakness in the way a legitimate piece of software loads additional files. This technique is known as DLL sideloading.

The name may sound complicated, but the basic idea is fairly simple. Imagine a legitimate program asking for a specific helper file. The computer expects that helper file to be safe because it is associated with the legitimate program. An attacker can sometimes place a malicious file where the program will find it first. The legitimate program then accidentally helps launch the malicious software.

In this case, researchers found evidence that BambooToken was using Tendyron’s OnKey software in this way. OnKey is legitimate security software associated with hardware-based authentication devices. These devices can be used to help verify someone’s identity when accessing systems, including systems used in financial and government environments.

Researchers emphasized that they did not find evidence that Tendyron’s software itself had been compromised. Instead, the attackers appear to have taken advantage of the way the legitimate software loads certain files. This distinction is important because it means the legitimate company and its software were not necessarily responsible for creating the malware.

BambooToken has also evolved over time. While early versions focused on Windows computers, researchers found evidence that newer versions began targeting Linux systems as well. That means the campaign is not limited to a single type of computer.

The malware can collect a considerable amount of information from infected systems. It can learn details about the computer and, in some cases, determine what security software is installed. This is particularly useful to an attacker because knowing which antivirus or security tools are protecting a computer can help them understand what defenses they may have to avoid.

Researchers also found evidence that BambooToken’s operators used Cloudflare to hide or protect some of the infrastructure used to control the malware. Cloudflare is a legitimate internet company that provides services designed to improve website performance and security. Criminals can sometimes abuse legitimate internet services to make their own infrastructure more difficult to identify.

The campaign appears to have affected a variety of organizations. Researchers identified compromised systems connected to mobile applications, a GitLab server in Hong Kong, a Vietnamese company developing a portable lifestyle device, a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency-related website in Lithuania, and a financial organization in Malaysia.

Researchers also identified infected routers in countries including Singapore, Cambodia, and Vietnam. This suggests that the campaign may have reached a broad range of organizations and internet-connected systems.

The information that could potentially be collected is one of the more concerning aspects of the campaign. An attacker who gains access to systems belonging to a financial organization could potentially learn about financial activity. Access to hotel systems could reveal information about guests and travel patterns, while compromised mobile applications or connected devices could provide information about how people use those products.

That does not necessarily mean all of this information was successfully stolen from every organization identified in the research. Rather, researchers believe the malware’s capabilities and the types of organizations it targeted could potentially allow attackers to gather valuable information from several different industries.

It is still unclear who is behind BambooToken. Researchers have pointed to several technical clues that may suggest a connection to China, but they have not publicly identified the individuals or organization responsible for the campaign. The researchers also noted similarities between BambooToken’s use of MQTT and another malware campaign that used the same technology, although there is no evidence proving that the two operations were connected.

The use of MQTT is particularly interesting because it gives the attackers another way to communicate with infected computers without relying entirely on more traditional methods. Because MQTT is a legitimate technology, its presence on a network is not automatically suspicious.

This is part of a larger trend in cybersecurity where attackers increasingly try to hide malicious activity among normal computer and internet traffic. Instead of creating an obviously suspicious communication channel, criminals can sometimes abuse legitimate programs, services, and technologies that organizations already trust.

For everyday computer users, the discovery of BambooToken is another reminder that malware does not always behave like the stereotypical computer virus. Modern threats can operate quietly in the background, use legitimate software as part of their attacks, and communicate through technologies that have completely legitimate purposes.

Keeping operating systems and applications updated, installing security updates when they become available, using reputable security software, and being cautious about unfamiliar downloads are still some of the most important ways to reduce the risk of malware infections. Organizations should also monitor unusual activity on their networks, particularly when legitimate programs begin behaving in unexpected ways.

The BambooToken campaign shows how much effort attackers can put into staying hidden. The malware has evolved over several years, expanded from Windows to Linux, changed the way it gets onto computers, and adopted a communication method that is normally associated with legitimate connected devices.

For now, researchers are continuing to investigate who is responsible and how widely BambooToken has been used. What is already clear, however, is that malware developers are becoming increasingly creative in the ways they hide their activities. Technologies designed to make computers and connected devices communicate more efficiently can also become tools for attackers when they are misused.