A new Windows-focused infostealer and remote access trojan (RAT) dubbed Dolphin X is being advertised on cybercrime forums with a clear pitch: automate the theft and triage of high-value corporate targets.
Unlike commodity stealers that focus mainly on browser passwords, Dolphin X is positioned as an enterprise-adjacent data vacuum with a built-in AI-powered victim scoring system designed to help attackers prioritize which compromised machines to exploit first.
According to the analysis, Dolphin X claims support for more than 300 application targets under its credential-looter category.
A single collection run can aggregate data into one archive from nine different browsers, over 100 wallet extensions, 65 desktop wallets, 10 password managers, and 30 cloud command-line tools.
Critically, its scope extends to cryptocurrency wallets, .env files, SSH keys, cloud tokens, and other DevOps and infrastructure credentials, giving operators potential access to everything from personal accounts to production cloud environments.
On developer workstations, .env files and SSH directories often contain over-scoped, long-lived secrets that can unlock build pipelines, admin consoles, and sensitive data stores if exfiltrated.
Varonis obtained the Dolphin X operator panel and analyzed it in a controlled lab environment, starting from the agent build workflow.
The operator client is a desktop-based configuration wizard: operators specify C2 endpoints, installation paths, persistence options, and evasion settings locally, but actual compilation is delegated to a backend service at backend.thedolphinx[.]top:8443.
Routing all builds through the vendor’s infrastructure gives the seller a choke point to mutate binaries server-side before delivery.
The panel exposes this as a three-tier “mutation engine,” with deeper obfuscation levels gated behind a paid PRO plan; the engine is turned off by default, and the panel explicitly notes that leaving it off results in identical hashes across builds.
The lowest mutation tier focuses on superficial yet detection-relevant metadata: rewriting PE timestamps, the Rich header, and section padding, all of which are common anchors for brittle YARA rules and hash-based blocklists.
Varonis Threat Labs identified the malware after spotting a listing by a seller using the handle “Kontraktnik,” who markets Dolphin X as an all-in-one RAT and credential-stealing platform.
The middle tier advertises shuffling the import table, altering the binary’s import hash between builds to frustrate import-based detection.
Windows Stealer Uses AI Profiling
The top tier claims deeper transformations, including control-flow rewrites, instruction substitution, and re-encryption of embedded strings with fresh keys per build, making it harder for defenders to lock onto stable byte patterns.
This model mirrors broader trends in crimeware-as-a-service, where sellers monetize automated polymorphism to help customers bypass static detections with minimal technical expertise.
Beyond data theft, Dolphin X’s operator panel includes a surveillance section exposing an “AI Profiler,” described by the seller as an “AI behavioral profiler with app usage tracking, risk score, and daily summary.”
The profiler monitors application usage, browsing behavior, and installed software, then scores each victim, returning daily-ranked summaries to operators.
In practice, this functions as an automated triage system for large botnets: instead of manually sifting through thousands of infected endpoints, attackers receive a prioritized list of “high-value” systems such as machines running cloud CLIs, IDEs, database clients, or administrative consoles to target for follow-on operations.
This aligns with a broader industry pattern where threat actors operationalize AI to scale targeting decisions and maximize monetization per compromised host.
On the wrong endpoint especially a developer or DevOps workstation a single Dolphin X infection can expose secrets that bridge directly into CI/CD pipelines, infrastructure-as-code platforms, and cloud consoles.
Given the stealer’s support for numerous wallet and password managers, the same incident can simultaneously compromise personal assets and corporate resources, complicating incident response and attribution.
The integration of an AI triage engine also reduces attacker overhead, enabling more focused use of advanced tradecraft such as hidden virtual network computing (HVNC), lateral movement, and post-exploitation frameworks on the most lucrative targets first.
Behavior such as explorer.exe running under a non-default desktop is highlighted by researchers as a strong indicator of HVNC-linked activity, independent of how the Dolphin X binary is packed or mutated.
Varonis emphasizes two primary defensive priorities in light of Dolphin X. First, reduce or eliminate long-lived credentials on disk: keep secrets out of project directories, environment files, and local credential stores wherever possible.
Second, shift detection emphasis from file signatures to behavior. Security teams should monitor for anomalies such as explorer.exe instances running under non-default desktops, suspicious cloud CLI usage patterns, and unusual access to credential stores.
IOCs
| Indicator | Type | Observed Role |
|---|---|---|
| backend.thedolphinx[.]top:8443 | Host and Port | Licensing, telemetry, and remote-build service |
| thedolphinx[.]top | Domain | Parent domain for the vendor backend |
| 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 | SHA-256 | Dolphin X operator panel client executable |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
 dubbed Dolphin X is being advertised on cybercrime forums with a clear pitch.){kind=link}