As threat actors continue to find new and creative ways to deliver malware, researchers have uncovered a novel technique being used to distribute two previously undocumented remote access trojans (RATs) named E4del and PINHOLE. By exploiting FTP server banners, hackers are able to hide malicious commands that instruct the malware stager on what actions to take. This unusual approach has been observed in the wild since early July 2026 and remains operational as of August 2026.
FTP banners are essentially text strings sent by an FTP server when a compromised system connects to it before login. Threat actors have discovered they can embed commands within these initial responses, allowing a malware stager to receive instructions from a remote server. MalwareHunterTeam first observed this technique in July 2026, and researchers at SOCRadar expanded their investigation, finding that the method has been weaponized since early July.
The infection chain begins with a ZIP archive that triggers an LNK-based infection chain, likely starting through phishing attacks. The initial compromise delivers two distinct RATs via FTP banners: E4del and PINHOLE. These malware variants support various malicious actions, including running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading additional payloads.
E4del is a Node.js-based RAT packaged inside a digitally signed Electron application masquerading as Discord. It supports running commands through shellcode fluctuation, keeping only one 4KB section of the payload in memory at a time. PINHOLE, on the other hand, retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions, offering versatility and resilience to take-downs.
The malware leaves a minimal footprint on infected hosts, injecting the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers.
While abusing FTP banners to deliver commands is a novel alternative, SOCRadar notes that this approach is less stealthy than traditional web-based dead-drop resolvers (DDR). FTP connections to unknown servers are more likely to stand out, making it easier for defenders to identify malicious activity. The technique’s versatility means it could easily be adapted for ClickFix social engineering campaigns.
To defend against these types of attacks, SOCRadar’s report provides indicators of compromise that can help identify the malicious infrastructure and infected machines on a network. It is essential to note that once attackers have valid credentials, prevention scores drop sharply, highlighting the importance of continuous monitoring and incident response planning.
As threat actors continue to adapt their tactics, it is crucial for defenders to stay vigilant and up-to-date with the latest threats. By understanding these novel techniques and staying informed about emerging malware variants, organizations can better prepare themselves against the ever-evolving cyber threat landscape.
Source: Bleeping Computer — 2026-08-21