Attackers have found an unusual hiding spot for malware commands: the greeting text that FTP servers display when a client connects. Threat intelligence firm SOCRadar spotted the technique in July 2026 and has been tracking it through August. The initial infection starts with a phishing email containing a ZIP archive. Inside is a Windows shortcut file (.LNK) that, when clicked, silently connects to an attacker-controlled FTP server. Instead of logging in, it reads the server’s banner — the plain-text welcome message shown before authentication — which has been pre-loaded with encoded instructions. This “dead-drop resolver” trick lets attackers swap out commands without touching the infected machine; they just update the FTP banner.
The two malware strains delivered through this channel are quite different from each other. E4del is a Node.js application bundled inside a fake, digitally signed Discord installer. Once running, it can execute commands, capture screenshots, stream the victim’s desktop in real time, and download additional payloads. PINHOLE takes a stealthier approach: it fetches its command-and-control configuration from Pinterest pin descriptions and SurveyMonkey survey questions — legitimate platforms that are hard to block. It keeps only 4KB of itself in memory at a time and injects its final payload into a suspended Windows system process to avoid detection. PINHOLE also supports credential theft from browsers. SOCRadar says the campaign appeared relatively new at time of analysis — PINHOLE had only been executed 11 times — but the infrastructure remained active through August.
Sources
- BleepingComputer — Hackers abuse FTP server banners to deliver new Windows malware
- SOCRadar — FTP Banners as New Dead-Drop Resolvers (research report, paywalled)