{"slug": "dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai", "title": "Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI", "summary": "Varonis Threat Labs discovered Dolphin X, a malware advertised on a cybercrime forum by a vendor using the alias “Kontraktnik,” that targets more than 300 applications including cryptocurrency wallets, SSH keys, and cloud tokens. The malware features an “AI Profiler” that scores infected users based on application usage and browsing activity, helping attackers identify high-value victims. Varonis obtained Dolphin X’s operator panel and analyzed it in an isolated lab, revealing a remote build system with server-side mutation and a collection scope that reaches beyond browser passwords to DevOps credentials.", "body_md": "Varonis Threat Labs discovered Dolphin X advertised on a cybercrime forum by a vendor using the alias “Kontraktnik.”\n\nThe listing claims the malware can target more than 300 applications and reaches far beyond browser passwords. Its collection capabilities include cryptocurrency wallets, .env files, SSH keys, cloud tokens, and other DevOps credentials.\n\nA single archive can contain data from nine browsers, more than 100 wallet extensions, 65 desktop wallets, 10 password managers, and 30 cloud command-line tools. This gives the malware potential access to everything from a victim’s personal accounts to the credentials used to manage their employer’s cloud environment.\n\nAnother feature, called the “AI Profiler,” scores infected users based on their application usage, browsing activity, and installed software. Attackers receive the rankings in a daily summary, helping them identify high-value victims and decide where to focus next.\n\nWe obtained Dolphin X’s operator panel and analyzed it in an isolated lab, beginning with how the agent is built.\n\nForum post advertising Dolphin X as an all-in-one RAT.\n\n## Remote build and mutation\n\nThe panel is a desktop client built around a configuration wizard, but nothing compiles on the operator's machine. The operator sets the agent's C2 address, installation path, persistence, and evasion options, then the client submits the configuration to backend.thedolphinx[.]top:8443, where compilation happens.\n\nBuild configuration submitted to the remote server.\n\nRouting every build through the vendor's server also gives the seller a place to modify each binary before it returns. The panel exposes this as an opt-in mutation engine with three tiers, the deeper two locked behind the PRO plan. The engine is off by default, and the panel itself notes that off means the same hash across all builds.\n\nServer-side mutation options are off by default and partly gated.\n\nDolphin X’s tiers are structured as follows:\n\n- The top tier claims to rewrite control flow, substitute instructions, and re-encrypt embedded strings with a fresh key, making stable byte sequences harder to identify.\n-\nThe middle tier advertises shuffling the import table, which would change the binary's import hash between builds.\n\n-\nThe lowest tier advertises rewriting PE timestamps, the Rich header, and section padding. These are the byte regions that brittle YARA rules and hash-based blocklists tend to anchor on.\n\n## Collection scope and AI profiling\n\nThe panel lists 329 features across ten categories. For defenders, however, the most important figure is the collection scope: more than 300 application targets appear under the credential-looter category. These targets range from browser logins and cryptocurrency wallets to SSH keys and cloud tokens, with the collected data staged in a single archive.\n\nFeature panel, with the 300+ collection targets under the credential looter category.\n\nOn a developer’s machine, .env files and SSH directories often contain over-scoped, long-lived credentials that can provide access to cloud consoles, build pipelines, and production data.\n\nBeyond credential collection, the panel includes a surveillance tab containing the AI Profiler. The seller describes it as an “AI behavioral profiler with app usage tracking, risk score, and daily summary.”\n\nIn practice, the feature appears designed to help operators triage victims.\n\nA cybercriminal may control thousands of infected machines, far more than they could review manually. The profiler acts like an automated warehouse sorter, scoring and tagging each victim before returning a ranked list of the most valuable machines to investigate first. The risk score and daily summary determine that order.\n\nSurveillance tab exposing the AI Profiler options.\n\n## Defenses and conclusion\n\nDolphin X’s collection scope reaches well beyond browser passwords to SSH keys, cloud tokens, and DevOps credentials. On the wrong machine, a single infection could expose access to an entire production environment.\n\nIts use of AI is also interesting because it shows us how AI is being integrated into more cybercrime tooling. We saw this with [SpamGPT](https://www.varonis.com/blog/spamgpt?hsLang=en) and [Bluekit](https://www.varonis.com/blog/bluekit?hsLang=en), and now with Dolphin X as well.\n\nThe practical response for security teams comes down to two things:\n\n-\nKeep long-lived credentials off disk wherever possible, especially out of project directories and local credential stores. Infostealers are designed to grab everything in one pass, so anything stored locally should be treated as potentially exposed.\n\n-\nFocus detection on behavior rather than file signatures. For example, explorer.exe running under a non-default desktop is a strong indicator of an HVNC session, regardless of how the malware binary is packed or what hash it uses.\n\n## Indicators of compromise\n\nThe controlled panel run and its traffic capture exposed several operator-side indicators.\n\nHost and port\n\nthedolphinx[.]top\n\n726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0\n\nSHA-256\n\n## MITRE ATT&CK techniques\n\nThe mapping below is a detection reference for this class of tool. Every row is a capability the listing advertises or the panel exposes, so it points to where to look.\n\nCredentials from Web Browsers\n\nT1555.003\n\nNine Chromium and Gecko browsers, with DPAPI decryption\n\nCredentials from Password Stores\n\nT1555\n\nMetaMask vault via PBKDF2 and Exodus seed via DPAPI\n\nCredentials in Files\n\nT1552.001\n\nSSH keys, .env files and more than 30 cloud CLI tokens\n\nArchive Collected Data\n\nT1560\n\nCollected credentials staged into a single archive\n\nProcess Injection\n\nT1055\n\nBypass User Account Control\n\nT1548.002\n\nT1547.001\n\nPersistence through Registry Run Keys or the Windows Startup folder\n\nT1053.005\n\nDisable or Modify Tools\n\nT1562.001\n\nNative API\n\nObfuscated Files or Information\n\nT1027\n\nThree-tier opt-in mutation engine, applied at build time\n\nT1090\n\nSOCKS5 reverse-proxy functionality\n\n*Note: We analyzed the operator panel and its network traffic, not a sample running on an infected machine. Unless stated otherwise, agent capabilities described above are exposed by the builder or claimed in the vendor’s documentation rather than independently confirmed in execution.*\n\nStay up to date on the threat landscape by following [Varonis Threat Labs](https://www.varonis.com/varonis-threat-labs?hsLang=en).\n\n### What should I do now?\n\nBelow are three ways you can continue your journey to reduce data risk at your company:\n\n[Schedule a demo with us](https://info.varonis.com/en/demo-request?hsLang=en) to see Varonis in action. We'll personalize the session to your org's data security needs and answer any questions.\n\n[See a sample of our Data Risk Assessment](https://www.varonis.com/hubfs/docs/DRA-sample.pdf?hsLang=en) and learn the risks that could be lingering in your environment. [Varonis' DRA](https://info.varonis.com/en/data-risk-assessment?hsLang=en) is completely free and offers a clear path to automated remediation.\n\nFollow us on[ LinkedIn](https://www.linkedin.com/company/varonis), [YouTube](https://www.youtube.com/channel/UCE9xUuH4lhIUDOFR1OHlNNg), and [X (Twitter)](https://twitter.com/varonis) for bite-sized insights on all things data security, including DSPM, threat detection, AI security, and more.", "url": "https://wpnews.pro/news/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai", "canonical_source": "https://www.varonis.com/blog/dolphin-x-stealer", "published_at": "2026-07-22 13:00:01+00:00", "updated_at": "2026-07-22 13:28:48.729675+00:00", "lang": "en", "topics": ["ai-agents"], "entities": ["Varonis Threat Labs", "Dolphin X", "Kontraktnik"], "alternates": {"html": "https://wpnews.pro/news/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai", "markdown": "https://wpnews.pro/news/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai.md", "text": "https://wpnews.pro/news/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai.txt", "jsonld": "https://wpnews.pro/news/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai.jsonld"}}