Hackers abuse FTP server banners to deliver new Windows malware
Hackers use FTP banners to hide commands delivering new Windows malware E4del and PINHOLE.
Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans, E4del and PINHOLE. This technique, observed since early July 2026, uses shortcut files and FTP banners as dead-drop resolvers to retrieve commands. E4del is a Node.js-based RAT disguised as Discord, while PINHOLE retrieves C2 configurations from platforms like Pinterest and SurveyMonkey.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Node.js?
Get an email when a new story names Node.js, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting a legitimate but rarely scrutinized FTP server feature — banner messages — as a covert channel to deliver commands and stage two novel RATs, E4del and PINHOLE. By abusing trusted platforms like Pinterest and SurveyMonkey as dead-drop resolvers for C2 configurations, attackers blend malicious traffic into normal web activity, making detection extremely difficult. E4del masquerades as Discord to evade application-layer controls, highlighting how disguised software can bypass naive allowlisting. This matters because organizations rarely monitor FTP banners for embedded commands or inspect outbound traffic to legitimate consumer web services, leaving a significant blind spot in their detection posture.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — E4del
- malware — PINHOLE