Threat actors are abusing FTP server banners—the greeting text a File Transfer Protocol server sends before login—as a way to deliver commands to Windows malware, according to BleepingComputer. The report says the technique is being used to distribute two previously undocumented remote access trojans, E4del and PINHOLE. BleepingComputer attributes the findings to MalwareHunterTeam observations and a SOCRadar investigation. MalwareHunterTeam reportedly spotted the method in July 2026 in an attack that used Windows shortcut files, or .LNK files, and FTP banners as dead-drop resolvers: remote locations that malware checks to retrieve instructions or configuration data. The mechanism is unusual because it uses a routine server response as the command channel. When a compromised host connects to an FTP server, the banner is returned before authentication. In the campaign described by SOCRadar, a malware stager reads commands embedded in that initial response and uses them to continue the infection chain. SOCRadar told BleepingComputer that its researchers expanded their search after seeing the technique during an investigation. Using FOFA searches, the firm found that the method had been weaponized since early July 2026 and was still operating, with new infrastructure observed as recently as August 2026. The reported attack flow starts with a ZIP archive that triggers an LNK-based infection chain. SOCRadar assesses that the initial compromise likely comes through phishing. From there, two separate infection routes retrieve a PowerShell script from FTP banners and deliver the E4del and PINHOLE remote access trojans. E4del is described as a Node.js-based RAT packaged inside a digitally signed Electron application that impersonates Discord. According to BleepingComputer’s summary of SOCRadar’s analysis, it can run commands through persistent or temporary shells, capture screenshots, stream the victim’s desktop over WebSockets, and download and execute additional payloads. SOCRadar also identified a Node.js module called crypto32.node that appears intended for privilege escalation, though the researchers could not retrieve it for analysis. PINHOLE uses a different resilience pattern. BleepingComputer reports that it retrieves command-and-control configuration from Pinterest pins and SurveyMonkey survey questions, a tactic designed to make takedowns harder by spreading configuration across legitimate web services. The malware reportedly keeps a minimal footprint by using shellcode fluctuation, retaining only one 4KB section of the payload in memory at a time, before injecting its final assembly into a suspended ApplicationFrameHost.exe process through Early Bird APC injection. SOCRadar says PINHOLE supports 14 commands, including file enumeration, uploads and downloads, command execution, process management, screenshot capture, and deployment of a browser credential-stealing module. At the time of analysis, the PINHOLE script showed only 11 execution events, which SOCRadar interpreted as a sign the campaign may still be early-stage. The defensive tradeoff is visibility. BleepingComputer reports that SOCRadar views FTP banners as a novel alternative to more common web-based dead-drop resolvers such as X, GitHub, or YouTube, but also less stealthy: outbound FTP connections to unfamiliar servers are more likely to stand out in enterprise telemetry than traffic to high-volume web platforms. Who benefits: Attackers gain another way to stage commands outside conventional web infrastructure. The technique may be useful in early campaigns because it is flexible and comparatively simple to adapt, according to SOCRadar’s assessment as reported by BleepingComputer. Who's exposed: Windows environments are exposed where users can be phished into opening ZIP archives and LNK files. Organizations with limited monitoring of outbound FTP traffic may miss the command retrieval step described in the report.