Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx[.]top)
Dolphin X Stealer (TL-2026-1621), also tracked as Dolphin X, is a high-severity malware campaign, first published 2026-07-22. It is attributed to Kontraktnik with low confidence, affects Microsoft Windows, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-1621
- Threat ID
- TL-2026-1621
- Also known as
- Dolphin X, Dolphin X Stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution
- Kontraktnik
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, cryptocurrency, software-development, government administration, health, retail, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Dolphin X Stealer
Malware and tooling: Dolphin X, Dolphin X Stealer, Dolphin X Linux/Debian port (in development), Dolphin X builder/operator panel
Dolphin X is a Windows infostealer sold as malware-as-a-service on cybercrime forums by vendor "Kontraktnik," targeting 300+ applications (browsers, password managers, crypto wallets, SSH keys, .env files, cloud CLI tokens, DevOps secrets) and offering stealer/HVNC/loader/DDoS-botnet functionality behind a server-side build system. Its standout feature is an AI behavioral profiler that scores infected victims by app usage and browsing history and pushes operators a daily ranked-by-payoff summary.
How Dolphin X Stealer works
Varonis Threat Labs (analyst Daniel Kelley) obtained access to the Dolphin X builder and operator panel — not a live sample — after the tool appeared for sale on a cybercrime forum under the alias "Kontraktnik," with the sales thread exceeding 3,000 views and at least two confirmed deals with positive vendor feedback as of the report. Dolphin X is a Windows-only .NET/native hybrid stealer (Debian-based operator tooling claimed by the vendor) marketed with the pitch "you can use it as a stealer, as an HVNC, as a DDoS botnet, as a loader," positioning it as a multi-purpose access-and-monetization platform rather than a single-purpose credential grabber.
The build pipeline is fully server-side: the operator configures the agent's C2 address, install path, persistence method, and evasion tier inside the panel, and the client submits that configuration to backend.thedolphinx[.]top:8443, where the binary is compiled and mutated before delivery. Nothing compiles on the operator's own machine, which both lowers the bar for less technical affiliates and complicates static-signature tracking since every build can be uniquely mutated server-side.
Collection scope spans nine Chromium/Gecko browsers, 100+ browser wallet extensions (including MetaMask), 65 desktop wallet applications (including Exodus), 10 password managers, and 30+ cloud CLI tools, in addition to SSH private keys, .env files, and general DevOps secrets — consolidated into a single exfiltration archive per victim. Browser credential theft relies on DPAPI decryption of locally stored secrets.
Defense evasion is built around a three-tier mutation engine (default disabled, top tier gated behind the PRO pricing plan): Tier 1 rewrites control flow, substitutes instructions, and re-encrypts embedded strings with a random per-build key; Tier 2 adds import-table shuffling; Tier 3 rewrites the PE timestamp, Rich header, and section padding. The malware also performs AMSI and ETW patching and issues direct syscalls to bypass user-mode API hooks, and exfiltrates over a SOCKS5 reverse-proxy channel. Persistence is achieved via Registry Run keys, the Windows Startup folder, or scheduled tasks, and the builder offers eight distinct launcher-host UAC bypass techniques for privilege escalation. Varonis notes that explorer.exe running under a non-default desktop is a strong host indicator of an active HVNC session.
The AI Profiler is the differentiating feature: rather than dumping raw stolen data on the operator, it applies a behavioral-scoring model against installed software, app usage patterns, and browsing history to rank victims by likely monetary payoff, then delivers a daily digest so lower-skilled affiliates can triage which infections to work first — effectively industrializing post-compromise victim selection for a MaaS customer base.
Pricing is tiered: Basic at roughly $80/month or $1,140 lifetime, Mid at roughly $230/month or $2,280 lifetime, and Pro at roughly $3,420 lifetime (Pro unlocking the full three-tier mutation engine; no monthly Pro rate was disclosed in reporting). Varonis catalogs the tool's total feature set at 329 discrete features organized across 10 functional categories. The tool includes a CIS-country infection-avoidance option and ships with English and Russian language support, both patterns consistent with a Russian-speaking cybercrime-forum vendor base. The vendor markets the current build as Windows-only but has publicly stated a Linux/Debian-targeting port is in development, indicating planned cross-platform expansion. No CVE, live-captured sample, or confirmed victim telemetry is available at time of publication; this record documents builder/panel capability as analyzed by Varonis (senior threat researcher Daniel Kelley, quoted as calling it probably one of the biggest stealers he has seen, covering the biggest attack surface), not observed in-the-wild exploitation.
MITRE ATT&CK techniques used in TL-2026-1621
Collection
T1005 Data from Local System; T1056.002 GUI Input Capture; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.006 Timestomp
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Command and Control
T1071 Application Layer Protocol; T1090.002 External Proxy
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
execution
Impact
T1498 Network Denial of Service
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder; T1548.002 Bypass User Account Control
privilege-escalation
T1548.002 Bypass User Account Control
Initial Access
Execution
Resource Development
T1583.004 Server; T1587.001 Malware
defense-impairment
Affected products and versions in Dolphin X Stealer
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11 - Multiple — Chromium/Gecko-based web browsers
Vulnerable versions: all versions storing DPAPI-protected local credential stores - MetaMask — MetaMask browser extension wallet
Vulnerable versions: all versions with locally-stored vault/keystore - Exodus — Exodus desktop crypto wallet
Vulnerable versions: all versions with locally-stored wallet data - Multiple — Password manager desktop/browser clients (10 supported)
Vulnerable versions: locally-cached vault data - Multiple — Cloud provider CLI tools (30+ supported, e.g. AWS/Azure/GCP-style credential files)
Vulnerable versions: local credential/config files
Remediation for Dolphin X Stealer
Immediate actions
- Block and monitor DNS/network traffic to thedolphinx[.]top and backend.thedolphinx[.]top:8443
- Hunt for explorer.exe processes running under a non-default desktop (HVNC indicator)
- Alert on AMSI/ETW provider tampering and direct syscall invocation patterns from unsigned or newly-dropped binaries
- Search endpoints for the published SHA-256 sample hash across EDR/AV telemetry
- Rotate credentials and revoke sessions/tokens for any host showing DPAPI mass-decryption activity against browser credential stores
Workarounds
- Restrict browser password-manager auto-fill/local storage of credentials on high-value endpoints (finance, DevOps, crypto-handling roles)
- Disable or tightly scope Windows Script Host / LOLBins commonly abused for stealer persistence and UAC bypass on standard user workstations
Longer-term hardening
- Move long-lived credentials, API keys, and cloud tokens out of on-disk project directories and .env files into a managed secrets vault
- Enforce hardware-backed or short-lived cloud CLI/DevOps tokens instead of static long-lived tokens
- Deploy EDR behavioral detection focused on process/registry/scheduled-task persistence and UAC-bypass technique families rather than static file signatures, since the malware's mutation engine defeats hash- and YARA-based detection
- Require MFA and hardware security keys for password manager and crypto wallet access to blunt credential-theft impact
- Baseline and alert on outbound SOCKS5 reverse-proxy connections from endpoints
Weaknesses (CWE) in Dolphin X Stealer
CWE-522, CWE-311, CWE-434
Timeline of Dolphin X Stealer
- Varonis Threat Labs (senior threat researcher Daniel Kelley) obtains access to the Dolphin X builder and operator panel for analysis.
- Varonis completes technical analysis of the three-tier mutation engine, AMSI/ETW patching, direct-syscall evasion, the eight launcher-host UAC-bypass techniques, and the AI Profiler victim-scoring feature.
- Varonis completes analysis of the server-side build pipeline at backend.thedolphinx[.]top:8443, documenting that binaries are compiled and mutated entirely server-side rather than on the operator's machine.
- At least two confirmed Dolphin X sales transactions with positive buyer feedback are logged on the forum thread as of July 21, 2026, per Varonis's monitoring.
- As of Tuesday, July 21, 2026, the Dolphin X sales thread on a cybercrime forum surpasses 3,000 views under vendor alias "Kontraktnik."
- TL-Intel Harness ingests the report via RSS hunt phase and opens threat record TL-2026-1621 for tracking; no CVE, live sample, or confirmed victim telemetry available at ingestion time.
- The Register publishes coverage of the Varonis findings at 14:00 UTC on Wednesday, July 22, 2026, quoting Daniel Kelley calling Dolphin X "probably one of the biggest stealers" he has seen and noting a Linux/Debian port is stated to be in development.
- Varonis Threat Labs publishes "Dolphin X Stealer" analysis on varonis.com/blog, cataloging 329 features across 10 functional categories and including the identified SHA-256 sample hash and thedolphinx[.]top infrastructure.
Sources cited for Dolphin X Stealer
- Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits
- Dolphin X Stealer
- StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
- A Quiet "Storm": Infostealer Hijacks Sessions, Decrypts Server-Side
- Storm Infostealer Sold as Service, Targets Browsers, Wallets and Accounts
Threats related to Dolphin X Stealer
- Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications
- Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel
- Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims
- ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
- Cross-Platform Node.js NPM Stealer — Browser Credentials, Sensitive File Exfiltration, and WebSocket Reverse Shell (SHA256 049300aa…ddeb9, C2 216.126.225.243)
- CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)
Detection coverage for TL-2026-1621
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1621 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.