--- title: Hackers abuse FTP server banners to deliver new Windows... description: Researchers at SOCRadar identified a novel malware delivery technique that abuses FTP server banners as dead-drop resolvers to deliver commands to two... canonical: https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers abuse FTP server banners to deliver new Windows malware | daily.dev og:description: Researchers at SOCRadar identified a novel malware delivery technique that abuses FTP server banners as dead-drop resolvers to deliver commands to two... og:url: https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz og:image: https://api.daily.dev/og/posts/8VC8PqDcZ.png og:image:alt: Hackers abuse FTP server banners to deliver new Windows malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers abuse FTP server banners to deliver new Windows malware **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Researchers at SOCRadar identified a novel malware delivery technique that abuses FTP server banners as dead-drop resolvers to deliver commands to two previously undocumented remote access trojans, E4del and PINHOLE. The infection chain starts with phishing-delivered ZIP archives containing LNK files. E4del is a Node.js-based RAT disguised as a signed Electron Discord app, capable of shell access, screenshots, and desktop streaming. PINHOLE fetches its C2 configuration from Pinterest pins and SurveyMonkey surveys, uses shellcode fluctuation and Early Bird APC injection into ApplicationFrameHost.exe to stay stealthy, and supports 14 commands including credential theft from browsers. The technique has been active since early July 2026, with new infrastructure seen as recently as August 2026, and researchers warn it could be adapted for ClickFix social engineering campaigns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the PINHOLE malware and how does it get its command and control instructions? PINHOLE is a Windows remote access trojan that retrieves its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions, giving it resilience against takedowns. It uses shellcode fluctuation to keep only a 4KB payload section in memory at a time and injects final code into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. It supports 14 commands, including file management, screenshots, and browser credential theft. _Security teams tracking novel C2 techniques like PINHOLE's can follow emerging threat research on daily.dev._ ### How are attackers using FTP server banners to deliver malware commands? Threat actors embed malicious commands inside the FTP banner, the greeting text an FTP server sends before login, so a compromised host retrieves instructions simply by connecting to the server. This dead-drop resolver technique was first observed in July 2026 by MalwareHunterTeam and expanded upon by SOCRadar, which found the infrastructure still active with new servers appearing as recently as August 2026. _daily.dev helps security researchers stay current on unconventional malware delivery techniques like this one._ ### What is the E4del malware and how is it disguised? E4del is a Node.js-based remote access trojan packaged inside a digitally signed Electron application that masquerades as Discord. It can run commands through persistent or temporary shells, capture screenshots, stream the desktop over WebSockets, and download and execute additional payloads, and it is delivered through a ZIP-and-LNK infection chain likely started via phishing. _Teams evaluating Electron app risks can track findings on trojanized clients like E4del through daily.dev._ ## Similar posts on daily.dev - [Zero-day hackers ditch exploits for a fake image file in new DarkMe campaign](https://daily.dev/posts/zero-day-hackers-ditch-exploits-for-a-fake-image-file-in-new-darkme-campaign-chtgrqusy) · IT Security Guru · 0 upvotes · 0 comments - [Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers](https://daily.dev/posts/fake-cloudflare-captcha-tricks-victims-into-opening-a-tunnel-for-attackers-gtqaorplr) · CSO Online · 0 upvotes · 0 comments - [Phishers Gain Persistence in EU, Asia Hospitality Orgs](https://daily.dev/posts/phishers-gain-persistence-in-eu-asia-hospitality-orgs-5fcvxyugq) · Dark Reading · 0 upvotes · 0 comments - [DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer](https://daily.dev/posts/darkme-rat-a-vb6-apt-trojan-turned-conventional-infostealer-5iigzsyq0) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers abuse FTP server banners to deliver new Windows malware","url":"https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz"},"datePublished":"2026-08-21T11:04:20.347Z","dateModified":"2026-08-21T11:04:58.067Z","description":"Researchers at SOCRadar identified a novel malware delivery technique that abuses FTP server banners as dead-drop resolvers to deliver commands to two...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6e2a3f9c48284314b9bab423955e174?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6e2a3f9c48284314b9bab423955e174?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,malware,phishing","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers abuse FTP server banners to deliver new Windows malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-abuse-ftp-server-banners-to-deliver-new-windows-malware-8vc8pqdcz#faq","mainEntity":[{"@type":"Question","name":"What is the PINHOLE malware and how does it get its command and control instructions?","acceptedAnswer":{"@type":"Answer","text":"PINHOLE is a Windows remote access trojan that retrieves its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions, giving it resilience against takedowns. It uses shellcode fluctuation to keep only a 4KB payload section in memory at a time and injects final code into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. It supports 14 commands, including file management, screenshots, and browser credential theft. Security teams tracking novel C2 techniques like PINHOLE's can follow emerging threat research on daily.dev."}},{"@type":"Question","name":"How are attackers using FTP server banners to deliver malware commands?","acceptedAnswer":{"@type":"Answer","text":"Threat actors embed malicious commands inside the FTP banner, the greeting text an FTP server sends before login, so a compromised host retrieves instructions simply by connecting to the server. This dead-drop resolver technique was first observed in July 2026 by MalwareHunterTeam and expanded upon by SOCRadar, which found the infrastructure still active with new servers appearing as recently as August 2026. daily.dev helps security researchers stay current on unconventional malware delivery techniques like this one."}},{"@type":"Question","name":"What is the E4del malware and how is it disguised?","acceptedAnswer":{"@type":"Answer","text":"E4del is a Node.js-based remote access trojan packaged inside a digitally signed Electron application that masquerades as Discord. It can run commands through persistent or temporary shells, capture screenshots, stream the desktop over WebSockets, and download and execute additional payloads, and it is delivered through a ZIP-and-LNK infection chain likely started via phishing. Teams evaluating Electron app risks can track findings on trojanized clients like E4del through daily.dev."}}]} ```