BambooToken Malware Uses MQTT to Control Windows and Linux Systems

thehackernews.com Sep 15, 2026

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Curated by Shubham · TechCapsules · Sep 15, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers uncovered BambooToken, a multi‑platform malware that has operated since February 2023, targeting Windows and Linux systems across Asia and South America. The campaign uses the MQTT protocol for command‑and‑control, a rare choice for malware. BambooToken is delivered via Tendyron’s OnKey USB security token, exploiting DLL sideloading to evade detection. The malware collects extensive system data, exfiltrates antivirus information, and has been observed communicating from Chinese IP addresses and Cloudflare‑proxied domains.

💡 Why It Matters

· The use of MQTT for remote control demonstrates a shift toward lightweight, IoT‑centric C2 channels, complicating traditional security monitoring.
· BambooToken’s exploitation of trusted hardware tokens underscores the vulnerability of even high‑security authentication devices to sophisticated supply‑chain attacks.

Capsules Cybersecurity

Read full article on thehackernews.com

Comp AI sets eyes on a continuously agentic future for security and…

Comp AI, a cybersecurity and compliance startup founded in January by Lewis Carhart, Claudio Fuentes and Mariano Fuentes, announced a $34 million Series A financing led by Roo Capital and Grand Ventures, bringing its total funding to $37.5 million. Drawing on lessons from their previous venture LeapAI—where manual SOC 2 compliance slowed product development—the trio built an “agentic” platform that automates policy drafting, evidence collection and continuous monitoring of compliance controls. The system also offers AI‑driven penetration testing and aims to keep security postures up‑to‑date as companies deploy new AI agents that could alter permissions or introduce vulnerabilities. Human oversight remains integral, with AI agents handling routine tasks while humans review and approve critical outputs.

💡 Real‑time, AI‑powered compliance monitoring addresses the gap between static audits and the rapid changes introduced by autonomous agents, protecting revenue‑critical security postures.

gizmodo.com · Sep 16

Best Antivirus for Windows 2026: 5 to Install, 1 to Avoid

A 2026 review ranks five paid Windows antivirus products and Microsoft Defender. Norton 360 tops the list, completing a full scan in 13 minutes 22 seconds and offering a robust firewall and 250 GB cloud backup. Bitdefender excels on older PCs, keeping CPU usage at 11 % and memory at 183 MB during a sweep. Avast One delivers a free, lab‑certified solution. NordVPN Threat Protection Pro provides full Windows protection for VPN subscribers. McAfee + offers unlimited device coverage but has the slowest scan. Microsoft Defender, free and built‑in, still shows gaps when the PC is off the network.

💡 The review highlights how performance, feature breadth, and pricing diverge across vendors, guiding users to match protection needs with system capabilities. It underscores that even the default Windows Defender is not a complete solution, prompting consideration of third‑party options.

infosecurity-magazine.com · Sep 16

Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program

SE Labs, a UK security testing firm, announced its six‑month PIVOT program on September 15 to benchmark cybersecurity vendors against the world’s most dangerous threat actors. The program employs a team of ethical hackers who simulate nation‑state and ransomware groups, testing vendors’ detection, interruption, and containment capabilities across full attack chains. Participants include Broadcom (Symantec, Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks, and Sophos. Testing began in July, will finish in October, and results are slated for release in January 2027. The initiative aims to give buyers clearer insight into vendor performance against evolving threats.

💡 By exposing real‑world attack scenarios, PIVOT offers a transparent, third‑party assessment that can shift purchasing decisions and pressure vendors to close critical gaps in threat detection and response.

thehackernews.com · Sep 15

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session…

Cybersecurity researchers uncovered the KREMLIN banking malware, active since May 2025, that lures Brazilian bank customers with fake documents and installs a malicious browser extension on Chrome and Edge. The multi‑stage payload uses JavaScript loaders, custom C++ installers, and blockchain‑based command‑and‑control via Ethereum smart contracts to evade detection. The extension bypasses Chromium integrity checks, harvests credentials, session tokens, and browser data, and exfiltrates it to a C2 server while maintaining persistence through scheduled tasks.

💡 The attack demonstrates how attackers combine browser exploitation with blockchain‑based infrastructure to create a resilient, stealthy threat that can adapt to security updates, posing a significant risk to online banking users worldwide.

thearabianpost.com · Sep 15

Cybersecurity shares advance as AI safety debate widens

Cybersecurity stocks surged on Monday as concerns about AI development prompted investors to shift from chip makers to firms expected to benefit from increased spending. CrowdStrike closed up 13.9% and Palo Alto Networks rose 13.1%, making them the top gainers in the S&P 500, while Nvidia, AMD and other chipmakers slipped. The rally extended to Zscaler, SentinelOne, Okta and Fortinet, and the iShares Expanded Tech‑Software Sector ETF jumped more than 5%, underscoring software outperformance. The move follows a debate among AI leaders, including Anthropic and OpenAI, about pausing frontier‑model development until safety mechanisms catch up. Analysts note AI‑enabled attackers increased 89% year‑over‑year, compressing breach response times to an average of 29 minutes, fueling demand for solutions such as CrowdStrike’s SafeMind models.

💡 Investors are betting that heightened AI‑driven threats will turn cybersecurity firms into the next growth engines, reshaping capital flows away from traditional chip stocks.

thequantuminsider.com · Sep 15

Entrust Turns CBOM Data Into Action With Expanded Cryptographic Security Platform

Entrust expanded its Cryptographic Security Platform (CSP) by adding CBOM import and export functions, enabling organizations to link cryptographic inventories with governance, risk assessment, and remediation. The update includes Ansible‑based certificate lifecycle automation, broader composite algorithm support, and SPIRE‑driven machine and AI identity capabilities. CSP is offered as a service or on‑premises, with options for post‑quantum migration and data sovereignty compliance. The move addresses regulatory demands such as U.S. Executive Order, EU DORA, and NIS2, which mandate CBOM‑based inventories.

💡 By turning CBOM data into actionable insights, the platform equips critical‑infrastructure operators to preemptively identify and remediate cryptographic vulnerabilities, thereby tightening security posture amid tightening regulatory scrutiny.