BambooToken: Lumen Black Lotus Labs documents MQTT C2 malware on Windows and Linux (Asia/South America)
Lumen Black Lotus Labs (report titled “The Banana Stand…”, summarised by The Hacker News and BleepingComputer on 15 September 2026) documents BambooToken, a previously under-reported malware family active since at least February 2023, with activity seen through July 2026 against organisations in Asia and South America (mobile apps, legal/financial, software development). Operators abuse DLL sideloading via Tendyron OnKey-related binaries (OnKeyToken_KEB.dll) without evidence the vendor’s code-signing cert/build was compromised; later variants use MQTT brokers (including Cloudflare-routed paths) for C2 plugin load/stop and host control on Windows and, from late 2025, Linux. Initial access vector undetermined. Hunt for unexpected OnKey-related DLL sideloads, MQTT client beacons to unfamiliar brokers, and related IoCs in the Lumen write-up. Primary: Lumen Black Lotus Labs; wires: THN / BleepingComputer.
- Product
- BambooToken malware (Windows/Linux; MQTT C2; Tendyron OnKey DLL sideload)
- Exploited in Australia?
- unknown
- Patch to
- Hunt OnKey DLL sideloads and anomalous MQTT C2; block listed IoCs from Lumen report; no product patch — defensive detection
Primary: Lumen Black Lotus Labs — The Banana Stand / BambooToken MQTT C2 · Vendor: Lumen Technologies — Black Lotus Labs report · The Hacker News — BambooToken MQTT (15 Sep 2026); also BleepingComputer