E4del and PINHOLE: FTP Banners Become Hidden Channels for Distributing Windows RATs

Campaign Active Since Early July

Two Windows remote access trojans, E4del and PINHOLE, are using an unusual technique to receive instructions: welcome banners exposed by FTP servers.

The campaign was observed in July and, according to research into publicly indexed infrastructure, was still active in August 2026. New servers appeared during August, suggesting that the operators continue to modify the network used for distribution.

The infection likely begins with a phishing message containing a ZIP archive. Inside is a chain based on Windows shortcut files, .LNK, which are often used to launch commands without directly presenting the user with a conventional executable.

The shortcut contacts an FTP server and reads the text returned during the connection. Content normally intended to display a service message before authentication is instead interpreted by the malware as a set of instructions.

FTP Banner Used as a Dead-Drop Resolver

This technique turns the FTP banner into a dead-drop resolver, or DDR. In this model, the server does not necessarily need to operate as a genuine command-and-control center; it only needs to return the data expected by the malware in its banner.

The .LNK file uses the server’s response to retrieve a PowerShell script, which continues the infection chain and downloads or launches subsequent components. Using a text message as a command container allows the operators to separate the distribution infrastructure from the final payload.

However, the approach also has a drawback. FTP connections to unknown servers may be more visible than traffic to legitimate platforms such as social networks, code-hosting services, or video sites. In previous campaigns, DDRs have also been hosted on services such as X, GitHub, and YouTube, where the traffic can blend more easily with normal activity.

Despite the risk of detection, the method is flexible. The same logic could be adapted to ClickFix social engineering scenarios, in which victims are tricked into manually running commands or procedures that appear necessary to resolve a problem.

E4del Masquerades as a Fake Discord Application

E4del is a Node.js-based RAT embedded in a digitally signed Electron application. The program presents itself as Discord, using a plausible name and interface to reduce user suspicion.

A digital signature does not prove that an application is legitimate. In this case, it is used inside a malicious package that embeds the Node.js component and remote-access functionality.

E4del can:

• execute commands through persistent or temporary shells;
• capture screenshots;
• stream the desktop through WebSockets;
• download and execute additional payloads.

These capabilities allow operators to move from initial execution to interactive control of the machine. They can also collect visual information, transfer new tools, and install additional components.

The infection chain also included the Node.js module crypto32.node, apparently linked to a possible privilege-escalation attempt. The module was not recovered for analysis, so its actual behavior and the level of privileges it can obtain remain unknown.

PINHOLE Combines Pinterest, SurveyMonkey, and Injection Techniques

PINHOLE uses a different infrastructure to retrieve its command-and-control configuration. The malware uses Pinterest pins and SurveyMonkey survey questions as data sources.

Using multiple services makes it harder to disrupt the communication completely. Removing a single piece of content or domain may not be enough, as the malware can continue obtaining part of its configuration from another platform.

On the compromised device, PINHOLE limits the amount of code kept in memory at any one time through a technique known as shellcode fluctuation. The payload is split into sections, with only one 4 KB section retained in memory at a time; the final assembly is reconstructed when needed.

The code is then injected into a suspended ApplicationFrameHost.exe process through Early Bird APC injection. This technique queues asynchronous calls before the process begins normal execution, using a legitimate process as a container.

PINHOLE supports 14 commands, including:

• collecting system information;
• uploading and downloading files;
• executing commands;
• managing processes;
• capturing screenshots;
• deploying a module to steal credentials stored in browsers.

During the analysis, the script had generated only 11 execution events. This is consistent with a campaign still in its early stages, although the figure alone cannot be used to estimate the scale of the activity.

Who Is at Risk and What Data Could Be Exposed

Potential victims include Windows users who open ZIP archives received through phishing or launch unverified .LNK shortcuts. Executing the shortcut can trigger PowerShell, establish FTP connections, and install the RAT without requiring the user to directly launch a recognizable executable.

The consequences depend on the available privileges and the payloads installed afterward. Observed capabilities include remote control, command execution, screenshots, desktop streaming, file transfers, and process management.

PINHOLE can also deploy a module designed to steal credentials saved in browsers. E4del may attempt privilege escalation through crypto32.node, but this has not been confirmed because the module was unavailable for analysis.

No specific victims, targeted sectors, or overall numbers of compromised systems have been disclosed.

Controls to Enable on Endpoints and Networks

Organizations should pay particular attention to:

• ZIP archives delivered through unexpected messages or from spoofed senders;
• .LNK files being launched, especially when they invoke PowerShell;
• PowerShell executions associated with FTP connections;
• FTP access to unknown external servers;
• banners containing strings or data inconsistent with a normal service message;
• Electron applications impersonating Discord;
• anomalous behavior from ApplicationFrameHost.exe;
• Early Bird APC injections and unusual access to browser databases.

Useful indicators of compromise for identifying infected servers and hosts are not available in the public data reviewed. Detection should therefore combine network telemetry, PowerShell events, process-creation data, and monitoring of Windows shortcuts.

Users should avoid opening unexpected ZIP files, refrain from executing .LNK files received by email, and verify the origin of Electron applications before installing them. Blocking or restricting outbound FTP traffic when it is not required for business operations can also reduce the attack surface.