E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands
- ID
- 17596
- Status
- summarized
- Published
- 25 Aug 2026, 7:33 PM
- Fetched
- 25 Aug 2026, 8:36 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/e4del-and-pinhole-rats-turn-ftp-banners.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 25 Aug 2026, 8:38 PM
- Tags
- Audience
- developers
What happened
Security researchers have documented the first in-the-wild use of FTP server welcome banners as dead drop resolvers to deliver two new RATs called E4del and PINHOLE. E4del is a Node.js-based RAT hidden inside a digitally signed Electron app masquerading as Discord, delivered via a multi-stage chain involving Spanish-language voucher lures, LNK files, WebDAV, and PowerShell.
Why it matters
Most builders don't need to change anything based on this. The only actionable detail is that E4del hides in a signed Electron binary posing as Discord—if you distribute Electron apps or manage endpoint allow-listing, note that code-signing alone is no longer sufficient to trust a binary. The FTP-banner C2 technique is novel but less stealthy than web-based DDRs and likely to be flagged by network controls.
Discussion angle
How attackers are increasingly abusing legitimate-looking app packaging (signed Electron apps, fake Discord) to bypass trust assumptions—and whether your team's endpoint controls would catch a signed but malicious Electron binary.