Dolphin X Malware: New AI Stealer Hits 300+ Apps

Dolphin X Malware Explained: The Windows Stealer That Uses AI to Pick Its Best Victims

Picture a ransomware affiliate sitting on top of 4,000 freshly stolen credential dumps. Manually sorting through that pile to find the one machine that belongs to a DevOps engineer with cloud admin rights would take days. Now imagine a piece of software that does that triage automatically, overnight, and hands the attacker a ranked shortlist by morning.

That is exactly the pitch behind Dolphin X, a newly surfaced Windows infostealer and remote access trojan (RAT) that security researchers at Varonis Threat Labs pulled apart after spotting it advertised on a cybercrime forum. It is not the biggest credential-stealing malware ever built, but it may be one of the first mainstream stealers to bolt on an "AI Profiler" whose entire job is to tell criminals which infections are worth their time.

If you run a SOC, manage endpoint security for a dev team, or just want to understand where infostealer malware is heading in 2026, this one is worth slowing down for.

Table of Contents

• What Is Dolphin X?
• How Varonis Discovered It
• What Dolphin X Actually Steals
• The AI Profiler: Why This Feature Matters
• Build Process, Mutation Engine, and Evasion Tricks
• Indicators of Compromise (IOCs)
• Detection Strategy for SOC Teams
• Prevention Checklist
• Expert Tips
• Related Reading
• FAQ
• Conclusion

What Is Dolphin X?

Dolphin X is a commercial malware kit sold on underground forums by a vendor operating under the handle "Kontraktnik." It is pitched to buyers as an all-in-one package: a credential stealer, a remote access trojan, a hidden VNC (HVNC) tool for covertly controlling a victim's desktop, a DDoS botnet client, and a loader for dropping additional payloads.

It runs on Windows only, is available in English and Russian, and according to Varonis' review of the operator panel, the vendor is already teasing a future Linux/Debian build. As of late July 2026, the forum listing had passed 3,000 views with at least two confirmed sales and positive buyer feedback — early signs that it is gaining traction in criminal circles, even though it has not yet been observed in a live, in-the-wild infection.

How Varonis Discovered It

Senior researcher Daniel Kelley of Varonis Threat Labs found the Dolphin X listing while monitoring cybercrime forum chatter. Rather than waiting to catch a live sample in the wild, the team obtained access to the malware's builder and operator panel directly and studied it inside an isolated lab, along with the network traffic it generated during setup.

That distinction matters for how you should read every claim in this article: Varonis is upfront that its findings come from the seller's own control panel, documentation, and build process — not from watching Dolphin X actually compromise a real victim machine. In other words, treat the vendor's feature list as advertised capability, not confirmed field-tested behavior, until independent detections surface.

What Dolphin X Actually Steals

The operator panel reportedly lists 329 individual features spread across ten categories, but the headline number is the credential-harvesting scope: the seller claims support for more than 300 applications in a single collection run. That includes:

• Nine web browsers (saved logins, cookies, autofill data)
• More than 100 cryptocurrency wallet browser extensions
• 65 desktop cryptocurrency wallets
• 10 password managers
• 30 cloud command-line interface (CLI) tools
• SSH private keys, .env configuration files, and cloud authentication tokens

This is where Dolphin X stops looking like a "grab the Chrome passwords" tool and starts looking like an enterprise access broker's dream. A single infected developer laptop can hand over API keys, database credentials, and long-lived cloud tokens sitting in project folders — the kind of secrets that open doors to production systems, source code repositories, and CI/CD pipelines, not just someone's Netflix account.

The AI Profiler: Why This Feature Matters

The feature drawing the most attention isn't the credential list — it's the AI Profiler, tucked inside a "surveillance" tab in the operator panel. According to the seller's own marketing copy, it functions as an AI-driven behavioral profiler that tracks application usage, browsing activity, and installed software, then assigns each infected machine a risk or value score.

Operators reportedly get a daily digest ranking their infected fleet, so instead of manually digging through thousands of stolen archives, they can jump straight to the machines most likely to belong to a developer, finance employee, system administrator, or crypto holder.

To be clear: this isn't an autonomous AI attacker making decisions on its own, and it isn't generating new exploits. Kelley described it as something he had "never seen before" in this class of stealer — the AI's job here is pure triage, not offense. But triage is exactly the bottleneck that has historically slowed down cybercriminal operations at scale, and automating it is a meaningful efficiency gain for the bad guys, not a cosmetic one.

Build Process, Mutation Engine, and Evasion Tricks

Dolphin X isn't compiled locally by the buyer. Instead, the operator panel sends selected settings — the command-and-control address, install path, persistence method, and evasion options — to a remote backend, which returns a freshly compiled payload. This "malware-as-a-remote-build-service" model is becoming increasingly common across the stealer and RAT market.

Subscription tiers reportedly unlock progressively stronger evasion:

• Entry tier (~$80/month): Rewrites PE timestamps, Rich headers, and section padding to dodge brittle YARA rules and hash-based blocklists.
• Mid tier: Shuffles the import table so the import hash changes on every build.
• Top tier: Deeper transformations — control-flow rewrites, instruction substitution, and re-encrypted embedded strings with a fresh key per build.

Persistence and defense-evasion capabilities advertised in the panel also include process injection, registry and scheduled-task persistence, UAC bypass methods, AMSI/ETW patching, and SOCKS5 proxy support for routing traffic through a compromised host.

The combined effect: static, hash-based antivirus signatures become far less reliable against a tool built to mutate on every single build.

Indicators of Compromise (IOCs)

Varonis published the following indicators tied to the Dolphin X vendor backend. IPs and domains below are intentionally defanged — re-fang only inside a controlled threat intel platform such as MISP, VirusTotal, or your SIEM.

Type	Indicator	Description
Host and port	backend.thedolphinx[.]top:8443	Licensing, telemetry, and remote-build service
Domain	thedolphinx[.]top	Parent domain for the vendor backend
SHA-256	726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0	Dolphin X operator panel client executable

Detection Strategy for SOC Teams

Because much of Dolphin X's evasion is designed to defeat static signatures, detection needs to lean on behavior rather than file hashes alone.

Get-Process explorer.exe | Select-Object Id, SessionId, Path

What it does: Lists running instances of explorer.exe along with their session ID and executable path. When to use it: Varonis specifically flagged that an explorer.exe process running under a non-default desktop session is a strong sign of an HVNC (Hidden VNC) session — regardless of how the malware sample was packed. Expected output: A table of process IDs and session IDs; anything running under a session or desktop context that doesn't match the logged-in user's normal interactive session deserves immediate follow-up.

Additional detection ideas worth building into your SIEM or EDR rule set:

• Alert on unexpected outbound connections to non-standard ports (like 8443) from endpoints that shouldn't be making licensing or telemetry calls.
• Flag processes attempting to read browser "Login Data" SQLite files, wallet extension local storage, or .env files in bulk within a short time window.
• Monitor for AMSI or ETW provider tampering, which is a strong signal of active defense evasion, not routine software behavior.
• Watch for scheduled task creation or registry Run-key modifications immediately following a suspicious download or macro execution.

Prevention Checklist

Varonis' guidance boils down to two priorities, and both are achievable without buying new tooling:

1. Reduce what's stored locally. Long-lived credentials, API keys, and cloud tokens sitting in project directories or unencrypted config files are exactly what a tool like Dolphin X is built to vacuum up. Move secrets into a managed vault or secrets manager instead of flat files.
2. Assume exposure, then rotate. Any credential that existed on a potentially infected endpoint should be treated as compromised — revoke it and issue a new one rather than waiting for confirmation of misuse.
3. Enforce MFA everywhere that supports it, especially on cloud consoles, source control, and admin panels, so a stolen password alone isn't enough for account takeover.
4. Limit standing credential permissions using least-privilege principles — a stolen SSH key is far less damaging if it can't reach production.
5. Train users to avoid unknown downloads and suspicious links, since infostealers increasingly arrive via fake software installers, cracked tools, or phishing pages rather than obvious malicious attachments.

Expert Tips

From a practitioner's seat, three things stand out about Dolphin X worth acting on this week, not next quarter:

• Don't wait for antivirus vendors to ship a signature. The mutation engine is specifically designed to outrun that model — get your EDR behavioral rules updated instead.
• If you run a bug bounty or red team exercise, add a check for locally stored .env files and SSH keys on developer workstations — this is precisely the low-hanging fruit tools like this are built to harvest.
• Treat "AI Profiler" style features as a preview of where commodity malware is headed. Expect more stealer kits to add automated victim scoring in the next 12 months, which means your detection strategy should assume attackers are getting faster at finding your highest-value assets, not slower.

Related Cybersecurity Topics You Should Explore

• Google Now Unlocks Accounts With a Selfie — Here's the Catch
  
• Notepad++ Under Attack: Fake Plugin Hides Malware
  
• RefluXFS: The Silent Linux Bug Giving Hackers Root Access
  
• This Google AI Finds, Proves, and Patches Hacks — Automatically
  
• Claude Security: Anthropic's AI Now Hunts Code Bugs
  
• Meta Paid $78K for a Bug That Exposed Your Private Chats
  
• Gemini 3.5 Flash Cyber: Google's AI Vulnerability Hunter
  
• CVE-2026-42533: The 15-Year-Old NGINX Bug Behind Pre-Auth RCE
  
• 15 Ways to Make Money in Cybersecurity in 2026 (Ranked)
  
• How Hackers Get Caught: 15 Free Email Investigation Tools 2026
  
• wp2shell: The WordPress Bug That Needs No Login to Hack You
  
• TP-Link Camera Flaw Lets Hackers on Your Wi-Fi Steal Admin Access
  
• Microsoft's Biggest Patch Tuesday Ever: 570 Bugs, 3 Zero-Days Exploited

Frequently Asked Questions

Is Dolphin X ransomware?
No. Dolphin X is an infostealer and remote access trojan focused on credential theft and remote control, not file encryption. That said, stolen credentials from tools like this are frequently sold on to ransomware affiliates as an initial access vector.

Has Dolphin X been seen infecting real victims yet?
As of the Varonis report, researchers had analyzed the builder, operator panel, and network traffic in a controlled lab — not a live infection in the wild. Early forum sales suggest it is starting to circulate, but confirmed victim cases had not been publicly documented at time of writing.

What operating systems does Dolphin X target?
Currently Windows only. The seller has reportedly mentioned plans for a future Debian/Linux variant.

What makes the "AI Profiler" different from normal infostealer features?
Most stealers just dump raw data for the attacker to sort through manually. Dolphin X automates that sorting by scoring victims based on app usage, browsing habits, and installed software, then delivering ranked daily summaries.

How can I tell if my organization is affected?
Check EDR and firewall logs for connections to the published IOC domain and port, review for unusual explorer.exe sessions, and treat any endpoint showing signs of credential-store access as a priority investigation.

What should I do if I suspect an infection?
Isolate the endpoint, rotate every credential that machine had access to, and review cloud and SSH access logs for anomalous logins from unfamiliar IPs before and after the suspected compromise window.

Does antivirus software catch Dolphin X?
Traditional hash- and signature-based detection is exactly what the malware's mutation engine is designed to evade. Behavior-based EDR detection is far more reliable against this class of threat.

Conclusion

Dolphin X is a reminder that the infostealer market keeps professionalizing. It's not the raw feature list that should worry defenders most — plenty of stealers already touch hundreds of apps — it's the shift toward automating the decision-making that used to require a human criminal sifting through stolen data by hand. When AI starts doing the triage instead of the theft, defenders need to respond by tightening what's stored locally, rotating fast when something looks off, and leaning on behavior detection instead of static signatures.

If this breakdown was useful, share it with your SOC team or subscribe for more real-world threat analysis — and drop a comment if you're seeing anything that looks like Dolphin X activity in your own environment.