Hackers Hide Malware Instructions in FTP Server Greetings

Key points

• Researchers at SOCRadar found attackers hiding commands inside FTP server banners, the short greeting text a server shows when a computer connects to it, to deliver malware to Windows PCs.
• The campaign has been running since early July 2026 and was still active in August 2026, using new servers as recently as last month.
• Two previously unknown remote access tools were dropped: E4del, disguised as the Discord chat app, and PINHOLE, which hides its instructions inside Pinterest pins and SurveyMonkey surveys.
• Victims are first tricked by a phishing email carrying a ZIP file with a booby-trapped shortcut (.LNK) inside.
• PINHOLE had logged only 11 executions at the time of analysis, suggesting the campaign is still small and early-stage.

Here is a novel one. Criminals are stuffing attack instructions into the greeting text that FTP servers show when a computer connects. That greeting, called a banner, is meant to say hello. In this campaign it says: run this.

The technique was flagged by threat intelligence firm SOCRadar and first reported by BleepingComputer. In practice, it is a fresh spin on an old trick called a dead-drop resolver, where malware fetches its orders from somewhere ordinary so the traffic looks unremarkable.

How does the attack actually work?

It starts with a phishing email carrying a ZIP file. Inside is a Windows shortcut file, the little icon type with the .LNK ending that normally points to a program. Open it and the shortcut quietly reaches out to an FTP server, reads the greeting banner, and pulls a PowerShell script out of that text. PowerShell is the scripting tool built into every modern Windows PC, and it is a favourite of attackers because it is already trusted by the system.

From there the script installs one of two remote access tools, known in the trade as RATs because they let an outsider control the machine as if they were sitting at it.

What are E4del and PINHOLE?

These are the two new remote-control programs the researchers pulled apart. E4del pretends to be Discord, the popular chat app, and is built on Node.js wrapped inside a signed Electron application, meaning it carries a digital signature that makes Windows less suspicious of it. It can open a shell, take screenshots, stream the desktop live over a web connection, and pull down more malware on demand.

PINHOLE is the sneakier of the two. It fetches its command-and-control settings from Pinterest pins and SurveyMonkey questions, so blocking one server does not kill it. It keeps just a 4KB slice of itself in memory at any moment and injects its final code into a suspended Windows process called ApplicationFrameHost.exe using a method called Early Bird APC injection. In plain terms: it hides in a program Windows already trusts. It supports 14 commands, including stealing passwords saved in web browsers.

Should ordinary people be worried?

Not directly, but the lesson is familiar. The way in was a phishing email with a ZIP attachment. If you get an unexpected file from someone you were not expecting to hear from, do not open it, even if the sender looks legitimate. If your work laptop suddenly runs slowly or your browser passwords behave oddly, tell your IT team.

SOCRadar notes the FTP trick is actually less stealthy than hiding commands on GitHub or YouTube, because a company laptop connecting to a random FTP server tends to stand out on a network log. The failure mode here is defenders who watch web traffic closely and treat FTP as legacy noise. One thing the post-mortem will say: nobody was looking at FTP banners.

Operational takeaway: if your egress rules still allow outbound FTP to arbitrary hosts, that is a monitoring gap worth closing this week.