BambooToken Malware Hides in Trusted Security Tokens

Cybersecurity researchers have identified a persistent malware campaign known as BambooToken, which has been active since early 2023. The threat actor leverages a lightweight communication protocol originally designed for internet of things devices to maintain remote control over compromised Windows and Linux machines. This approach allows the malware to blend in with normal network traffic, making detection significantly more difficult for standard security tools.

The campaign targets organizations in Asia and South America, with recent activity detected as late as July 2026. According to Lumen Black Lotus Labs, the initial method of delivery remains unknown, but the actor uses software from Tendyron, a provider of high-security USB tokens, to install malicious components. By hijacking a trusted authentication tool, the attackers bypass many traditional perimeter defenses that would otherwise flag unauthorized software.

Abuse of trusted security tokens

Tendyron OnKey is a hardware-based token used in financial and government sectors to verify user identities. The malware does not compromise Tendyron’s code-signing certificate. Instead, it exploits a vulnerability in the software itself, a technique known as DLL sideloading. This allows the attacker to load a rogue version of a system library, effectively giving the malware the same level of trust as the legitimate security tool.

This method is particularly effective because security software often whitelists known, signed executables. By hiding inside a program designed to protect networks, the malware avoids triggering alerts that would fire if it were running as an unknown file. The trade-off for the attacker is a higher barrier to entry, requiring specific knowledge of the target’s authentication infrastructure, but the reward is sustained, covert access to sensitive systems.

Using IoT protocols for command control

BambooToken uses the Message Queueing Telemetry Transport protocol to communicate with its command-and-control server. MQTT is a publish-subscribe protocol that is lightweight and efficient, making it ideal for low-bandwidth devices like sensors and smart home gadgets. However, its use in cybercrime is not new. Previous groups, including Mustang Panda and the Bamboo Spider collective, have employed similar tactics to hide their traffic.

The choice of protocol creates a specific challenge for defenders. Because MQTT traffic is often allowed through corporate firewalls to support legitimate industrial or IoT devices, malicious commands can travel without raising suspicion. The malware sends system details to a remote server and receives instructions to load plugins or terminate execution. This steady, low-volume communication pattern is harder to distinguish from normal device chatter than the large data transfers typical of ransomware or data exfiltration.

Expansion to Linux systems

Initially, the malware relied on PowerShell scripts to initiate infection on Windows systems. This stager allocated memory and executed the malicious payload, a method that researchers believe was chosen to minimize detection by endpoint detection and response tools. As of late 2025, the campaign has expanded to include Linux hosts, broadening its impact on server environments that are often less protected than desktop workstations.

The shift to Linux and the continued reliance on MQTT indicate a sophisticated, long-term espionage or data collection operation. The actor’s ability to remain undetected for years suggests a high level of skill and patience. For organizations, the risk lies not just in the immediate compromise, but in the potential for long-term surveillance and lateral movement within the network. The use of a trusted vendor’s software as a vector underscores the need for rigorous integrity checks on all signed binaries, even those from reputable sources.