Cybersecurity researchers have identified an unusual malware campaign in which attackers are abusing FTP server banners to hide commands used to deliver two previously undocumented Windows remote access trojans, E4del and PINHOLE. The technique uses the greeting messages normally displayed by FTP servers as a mechanism for retrieving malicious instructions.
MalwareHunterTeam first observed the activity in July during an attack involving Windows shortcut files and FTP server banners used as dead-drop resolvers. Researchers later found that the technique remained active into August 2026, with new infrastructure continuing to appear.
FTP banners are text strings displayed by servers when a device connects before logging in. By embedding commands inside these initial responses, attackers can allow compromised systems to retrieve instructions from remote infrastructure without relying solely on more conventional web-based command channels.
LNK Files and FTP Banners Used in Infection Chain
Researchers at SOCRadar expanded their investigation after discovering FTP banners being used to deliver malicious commands. Their analysis indicated that the technique had been weaponised since early July 2026 and remained operational in August.
The observed attacks begin with a ZIP archive containing a Windows shortcut, or LNK, file. Researchers said the initial compromise likely occurs through phishing.
Once opened, the shortcut triggers an infection chain that connects to an FTP server and retrieves instructions embedded in its banner. Both malware routes ultimately fetch PowerShell scripts through these FTP responses.
The approach effectively turns the FTP server greeting into a remote instruction channel. Researchers described the technique as an alternative form of dead-drop resolver infrastructure, where attackers use an external service or resource to point infected systems towards further commands or payloads.
E4del and PINHOLE Remote Access Trojans Delivered
The infection chain delivers two remote access trojans identified as E4del and PINHOLE.
E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord. The malware can execute commands through temporary or persistent shells, capture screenshots, stream a victim’s desktop through WebSockets and download and run additional payloads.
Researchers also identified a Node.js module named crypto32.node that appeared designed to attempt privilege escalation, although they were unable to obtain the module for further analysis.
PINHOLE follows a different execution route and retrieves its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions. Researchers said this approach gives the malware additional flexibility and resilience against infrastructure takedowns.
The malware attempts to reduce its footprint on infected systems by keeping only a small portion of its payload in memory at a time. It then injects the final assembly into a suspended ApplicationFrameHost.exe process using Early Bird APC injection.
PINHOLE Supports Credential Theft and Multiple Remote Commands
PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, screenshots and deployment of a module designed to steal credentials stored in web browsers.
At the time of analysis, researchers had observed only 11 PINHOLE execution events, suggesting that the campaign was still in an early stage.
SOCRadar said the use of FTP banners provides attackers with an alternative to commonly abused web services such as X, GitHub and YouTube. However, the technique may be less stealthy because connections to unfamiliar FTP servers can stand out more clearly in network monitoring.
Researchers nevertheless said the method is versatile and could be adapted for other attack techniques, including ClickFix-style social engineering campaigns.
The investigation also produced indicators of compromise intended to help defenders identify malicious infrastructure and potentially infected systems. The continuing appearance of new infrastructure indicates that the technique remained active at the time of the researchers’ latest observations.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
