Attackers are exploiting the welcome messages displayed by FTP servers when a connection begins to hide malicious commands used to deliver two new remote-access malware programs on Windows: E4del and PINHOLE. MalwareHunterTeam observed the technique during an attack that emerged in July 2026, before the threat-intelligence platform SOCRadar expanded the research and confirmed that its use continued through August.
An FTP welcome message is text sent by the server to the connecting device before login. In this campaign, commands are embedded in the initial response received by the compromised system, allowing a preliminary program to use them to retrieve instructions from a remote server. This resembles using the server as a dead-drop resolver, but through an FTP channel rather than common web services.
How Does the Infection Begin?
According to the SOCRadar report, the chain begins with a ZIP file, which researchers believe is initially delivered through phishing. Opening the archive triggers an infection chain based on .LNK shortcut files and follows two different paths to install E4del or PINHOLE. In both paths, PowerShell code is extracted from FTP server welcome messages.
E4del and PINHOLE Capabilities
E4del is built on Node.js inside a digitally signed Electron application that masquerades as a Discord application. It supports command execution through temporary or persistent Shell sessions, screenshot capture, desktop streaming over WebSockets, and the downloading and execution of additional payloads. The researchers also pointed to a Node.js module named crypto32.node that attempts to elevate privileges, but they were unable to obtain it for analysis.
PINHOLE extracts its command-and-control connection settings from Pinterest posts and SurveyMonkey survey questions. This method gives it flexibility in changing its sources and makes disruption more difficult. The program uses a technique known as Shellcode Fluctuation, retaining only a 4-kilobyte section of the payload in memory at a time, then injecting the final assembly into a suspended process named ApplicationFrameHost.exe through Early Bird APC Injection.
PINHOLE supports fourteen commands, including file enumeration, uploading and downloading files, command execution, process management, screenshot capture, and deploying a module to steal credentials saved in browsers. At the time of analysis, the program had recorded only 11 execution events, indicating that the campaign was at an early stage.
Why Does This Technique Matter?
Using FTP messages represents an unusual alternative for passing commands, but it is not necessarily stealthier than relying on web services such as X, GitHub, and YouTube. Connections to unknown FTP servers may be more apparent to defense teams, especially when they do not match the usual usage pattern within the network. The researchers believe the technique could be adapted for ClickFix-style social-engineering campaigns.
SOCRadar said that searches using FOFA showed the technique had been weaponized since early July 2026, with new infrastructure appearing in August. Its report includes indicators of compromise that can be used to identify malicious servers and infected devices within networks.