Researchers at SOCRadar identified a novel malware delivery technique that abuses FTP server banners as dead-drop resolvers to deliver commands to two previously undocumented remote access trojans, E4del and PINHOLE. The infection chain starts with phishing-delivered ZIP archives containing LNK files. E4del is a Node.js-based RAT disguised as a signed Electron Discord app, capable of shell access, screenshots, and desktop streaming. PINHOLE fetches its C2 configuration from Pinterest pins and SurveyMonkey surveys, uses shellcode fluctuation and Early Bird APC injection into ApplicationFrameHost.exe to stay stealthy, and supports 14 commands including credential theft from browsers. The technique has been active since early July 2026, with new infrastructure seen as recently as August 2026, and researchers warn it could be adapted for ClickFix social engineering campaigns.
Table of contents
Related Articles:Questions this post answers
What is the PINHOLE malware and how does it get its command and control instructions?
PINHOLE is a Windows remote access trojan that retrieves its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions, giving it resilience against takedowns. It uses shellcode fluctuation to keep only a 4KB payload section in memory at a time and injects final code into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. It supports 14 commands, including file management, screenshots, and browser credential theft. Security teams tracking novel C2 techniques like PINHOLE's can follow emerging threat research on daily.dev.
How are attackers using FTP server banners to deliver malware commands?
Threat actors embed malicious commands inside the FTP banner, the greeting text an FTP server sends before login, so a compromised host retrieves instructions simply by connecting to the server. This dead-drop resolver technique was first observed in July 2026 by MalwareHunterTeam and expanded upon by SOCRadar, which found the infrastructure still active with new servers appearing as recently as August 2026. daily.dev helps security researchers stay current on unconventional malware delivery techniques like this one.
What is the E4del malware and how is it disguised?
E4del is a Node.js-based remote access trojan packaged inside a digitally signed Electron application that masquerades as Discord. It can run commands through persistent or temporary shells, capture screenshots, stream the desktop over WebSockets, and download and execute additional payloads, and it is delivered through a ZIP-and-LNK infection chain likely started via phishing. Teams evaluating Electron app risks can track findings on trojanized clients like E4del through daily.dev.