Two previously undocumented remote access trojans — E4del and PINHOLE — are being delivered by a method nobody had catalogued: instructions hidden in the greeting banner of an FTP server.

MalwareHunterTeam first saw it in July 2026. SOCRadar confirms the campaign was still active in August.

What an FTP banner is doing here

When you connect to an FTP server, it sends a greeting line before you authenticate. It is meant for a version string or a notice.

Here it carries commands. The compromised machine connects, reads the banner, and acts on what it finds — before logging in, which means the operator does not need to maintain accounts or care whether authentication succeeds.

This is a dead-drop resolver: the malware does not carry its command server address, it goes somewhere neutral to be told. The usual version uses a social media profile or a paste site.

The chain

  • A phishing email delivers a ZIP
  • Inside is a .LNK shortcut file
  • The shortcut connects to an attacker-controlled FTP server and extracts commands from the banner
  • A PowerShell script is retrieved and executed
  • Either E4del or PINHOLE is deployed, by separate routes

The two payloads are very different animals

E4del is a Node.js trojan wearing Discord's clothes — packaged inside a digitally signed Electron application. It runs commands through persistent or temporary shells, takes screenshots, streams the desktop over WebSockets, downloads further payloads, and may escalate privileges through a module named crypto32.node.

PINHOLE is the quieter one. It pulls its command-and-control configuration from Pinterest pins and SurveyMonkey surveys, keeps a minimal footprint using shellcode fluctuation, and injects itself into a suspended ApplicationFrameHost.exe using Early Bird APC injection. It supports 14 commands covering file operations, screenshots, credential theft and process management.

Novel is not the same as good

SOCRadar makes a point that most coverage of a new technique skips: FTP connections to unknown servers are more likely to stand out than the web-based dead drops everyone else uses.

That is worth sitting with. A corporate endpoint making an outbound FTP connection is unusual in 2026. HTTPS to a content platform is not, which is exactly why PINHOLE's own C2 configuration lives on Pinterest and SurveyMonkey — the well-proven approach, in the same campaign, alongside the novel one.

So the interesting question is not how clever the FTP trick is. It is why an operator with good tradecraft in one component chose a delivery channel that is easier to spot. The same tension appeared in the MacSync campaign, where domains were disguised as small businesses while the API key never rotated.

SOCRadar's warning is that the technique adapts easily — a ClickFix campaign could carry it as readily as a phishing attachment.

What to do

  • Alert on outbound FTP from endpoints. Almost nothing legitimate needs it, which makes it a high-signal, low-noise detection.
  • Block .LNK files at the mail gateway, and inside archives. A shortcut in a ZIP has no honest use.
  • Watch for LNK spawning network activity, then PowerShell. That sequence is the whole chain.
  • Do not trust a signature on an Electron app. E4del is digitally signed and pretending to be Discord.
  • Treat Pinterest and SurveyMonkey traffic as a possible C2 channel, not as social noise, on hosts that have no reason to reach them.

What is not established

  • Who is running it. No actor named.
  • How many victims. No count published.
  • Whether E4del and PINHOLE share an operator, beyond arriving through the same delivery chain.
  • What the targeting is. No sector or region has been reported.