Threat actors are using FTP server banners to hide commands that deliver two previously undocumented remote access trojans (RATs) called E4del and PINHOLE.
Researchers at SOCRadar found the technique in attacks that began in July 2026 and are still active. The attacks reportedly start with ZIP files that use shortcut (.LNK) files to begin the infection. The attackers then use FTP banners to deliver PowerShell commands to infected systems.
E4del is a Node.js-based RAT disguised as a signed Discord application. It can run commands, take screenshots, stream the desktop and download additional malware.
PINHOLE uses Pinterest pins and SurveyMonkey questions to obtain its command-and-control settings. It can manage files and processes, run commands, take screenshots and steal credentials stored in web browsers. The malware also uses techniques designed to reduce its presence in memory. At the time of the analysis, PINHOLE had been executed only 11 times, suggesting the campaign was in its early stages.
“The identification of FTP banners as DDRs presents a creative, albeit less stealthy, evolution in malware delivery, allowing threat actors to embed malicious commands directly within the protocol’s banner. Although initial access methods point to shortcut-file phishing, attackers could easily adapt FTP banner abuse for ClickFix campaigns as well,” the researchers warned.