Ankura CTIX FLASH Update – August 26, 2026

Malware Activity

Attackers Hide Advanced Malware in Familiar Internet Services and Developer Tools

Cybercriminals are increasingly hiding malware inside trusted-looking technology, including FTP server welcome messages and legitimate software packages. In one (1) campaign, phishing emails deliver malicious shortcut files that retrieve hidden PowerShell commands from FTP banners and install the E4del or PINHOLE remote access trojans. These tools can execute commands, steal files and browser credentials, capture screenshots, monitor desktops, and download additional malware onto Windows systems. The attackers also concealed communications through familiar platforms such as Discord, Pinterest, and SurveyMonkey, although connections to unknown FTP servers may still be noticeable to security teams. In a separate software supply chain attack, researchers identified fourteen (14) functional npm packages that secretly install the AI-enabled RedC2 4.0 backdoor on Linux devices when the