Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx[.]top)

Key facts for Dolphin X MaaS stealer

Detection coverage for Dolphin X MaaS stealer

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1621 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dolphin X — Mass Browser Credential Store (DPAPI) Access, Wallet/SSH/.env Enumeration, and Archive Consolidation

Detects the post-exploitation collection chain: rapid enumeration/read access to browser DPAPI-protected credential stores, crypto wallet files (MetaMask/Exodus), SSH keys, .env files, and cloud CLI credential files, followed by consolidation into a single archive — the signature Dolphin X 'single exfil bundle per victim' pattern.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.003, T1552.001, T1555, T1528, T1005, T1560
• Data sources: sysmon, windows_security, edr_file_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval fname=lower(TargetFilename)
| where like(fname, "%login data%") OR like(fname, "%cookies%") OR like(fname, "%key4.db%") OR like(fname, "%.env%") OR like(fname, "%id_rsa%") OR like(fname, "%metamask%") OR like(fname, "%exodus%") OR like(fname, "%\\.aws\\credentials%")
| bin _time span=5m
| stats dc(fname) as unique_targets values(fname) as files_touched count by _time, Computer, Image, User
| where unique_targets >= 4
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      | eval fname=lower(TargetFilename)
      | where like(fname, "%.zip") OR like(fname, "%.rar") OR like(fname, "%.tar.gz")
      | stats count by Computer, Image, User, fname ]
| table _time, Computer, User, Image, unique_targets, files_touched

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName has_any ("Login Data", "Cookies", "key4.db", ".env", "id_rsa", "metamask", "exodus", "credentials")
| summarize UniqueTargets=dcount(FileName), Files=make_set(FileName), Count=count() by bin(Timestamp, 5m), DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where UniqueTargets >= 4
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName endswith ".zip" or FileName endswith ".rar" or FileName endswith ".tar.gz"
    | project ArchiveTime=Timestamp, DeviceName, ArchiveFile=FileName
) on DeviceName
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, UniqueTargets, Files, ArchiveFile, ArchiveTime

Sigma

title: Mass Credential Store and Wallet/SSH/.env File Access Followed by Archive Creation (Dolphin X Collection Pattern)
id: 3a4b5c6d-1e2f-4a8b-9c0d-2e3f4a5b6c72
status: experimental
description: Detects broad enumeration of browser credential stores, crypto wallet vaults, SSH keys, and .env/cloud-CLI credential files within a short window, followed by single-archive consolidation — matching the Dolphin X stealer's collection-and-bundle behavior
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1552.001
    - attack.collection
    - attack.t1560
    - attack.t1005
    - attack.malware.dolphin_x
logsource:
    category: file_event
    product: windows
detection:
    selection_targets:
        TargetFilename|contains:
            - 'Login Data'
            - 'Cookies'
            - 'key4.db'
            - '.env'
            - 'id_rsa'
            - 'metamask'
            - 'exodus'
            - '\.aws\credentials'
    condition: selection_targets | count() by Computer, Image, User > 3
falsepositives:
    - Endpoint backup, migration, or DLP scanning tools legitimately reading these paths
    - Password manager or browser-sync utilities performing bulk profile access
level: high

Known false positives:

• Legitimate password manager sync/migration tools, endpoint backup software, DLP content-inspection scanners touching similar paths in bulk

Tuning notes: Tune the unique_targets threshold (currently 4) per environment baseline; exclude known-good backup/EDR agent process hashes; correlate with the C2 callout detection (SPL-001/KQL-001) for higher-confidence alerting.

• 🔒 Dolphin X — Phishing-Delivered Loader Reaching Server-Side Build Backend · unlock with TL Creds
• 🔒 Dolphin X — Registry Run Key / [indicator] Referencing User-Writable Path · unlock with TL Creds
• 🔒 Dolphin X — AMSI/ETW Tampering and Direct Syscall Invocation from Unsigned Binary · unlock with TL Creds
• 🔒 Dolphin X — Phishing-Origin Loader Executing Recently-Dropped Binary (Exploitation Stage) · unlock with TL Creds
• 🔒 Dolphin X — PE Timestomp / Rich-Header Anomaly with UAC-Bypass Launcher Chain (Post-Exploitation) · unlock with TL Creds
• 🔒 Dolphin X — Repeated Scheduled Task / Cron Persistence Entries With Generic Marker Names Beaconing Outbound (C2/Lateral Movement) · unlock with TL Creds
• 🔒 Dolphin X — Server-Side Build Backend C2/Delivery Callout ([indicator]:8443) · unlock with TL Creds
• 🔒 Dolphin X — HVNC Non-Default-Desktop Explorer.exe and SOCKS5 Reverse-Proxy Beacon · unlock with TL Creds

Indicators of compromise for Dolphin X MaaS stealer

As of 2026-07-22, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-1621.

Sample indicators (2 of 22)

• Domain: thedolphinx[.]top
• File hash: 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How Dolphin X MaaS stealer works

Its standout feature is an AI behavioral profiler that scores infected victims by app usage and browsing history and pushes operators a daily ranked-by-payoff summary.

Varonis Threat Labs (analyst Daniel Kelley) obtained access to the Dolphin X builder and operator panel — not a live sample — after the tool appeared for sale on a cybercrime forum under the alias "Kontraktnik," with the sales thread exceeding 3,000 views and at least two confirmed deals with positive vendor feedback as of the report. Dolphin X is a Windows-only .NET/native hybrid stealer (Debian-based operator tooling claimed by the vendor) marketed with the pitch "you can use it as a stealer, as an HVNC, as a DDoS botnet, as a loader," positioning it as a multi-purpose access-and-monetization platform rather than a single-purpose credential grabber.

The build pipeline is fully server-side: the operator configures the agent's C2 address, install path, persistence method, and evasion tier inside the panel, and the client submits that configuration to backend.thedolphinx[.]top:8443, where the binary is compiled and mutated before delivery. Nothing compiles on the operator's own machine, which both lowers the bar for less technical affiliates and complicates static-signature tracking since every build can be uniquely mutated server-side.

Collection scope spans nine Chromium/Gecko browsers, 100+ browser wallet extensions (including MetaMask), 65 desktop wallet applications (including Exodus), 10 password managers, and 30+ cloud CLI tools, in addition to SSH private keys, .env files, and general DevOps secrets — consolidated into a single exfiltration archive per victim. Browser credential theft relies on DPAPI decryption of locally stored secrets.

Defense evasion is built around a three-tier mutation engine (default disabled, top tier gated behind the PRO pricing plan): Tier 1 rewrites control flow, substitutes instructions, and re-encrypts embedded strings with a random per-build key; Tier 2 adds import-table shuffling; Tier 3 rewrites the PE timestamp, Rich header, and section padding. The malware also performs AMSI and ETW patching and issues direct syscalls to bypass user-mode API hooks, and exfiltrates over a SOCKS5 reverse-proxy channel. Persistence is achieved via Registry Run keys, the Windows Startup folder, or scheduled tasks, and the builder offers eight distinct launcher-host UAC bypass techniques for privilege escalation. Varonis notes that explorer.exe running under a non-default desktop is a strong host indicator of an active HVNC session.

The AI Profiler is the differentiating feature: rather than dumping raw stolen data on the operator, it applies a behavioral-scoring model against installed software, app usage patterns, and browsing history to rank victims by likely monetary payoff, then delivers a daily digest so lower-skilled affiliates can triage which infections to work first — effectively industrializing post-compromise victim selection for a MaaS customer base.

Pricing is tiered: Basic at roughly $80/month or $1,140 lifetime, Mid at roughly $230/month or $2,280 lifetime, and Pro at roughly $3,420 lifetime (Pro unlocking the full three-tier mutation engine; no monthly Pro rate was disclosed in reporting). Varonis catalogs the tool's total feature set at 329 discrete features organized across 10 functional categories. The tool includes a CIS-country infection-avoidance option and ships with English and Russian language support, both patterns consistent with a Russian-speaking cybercrime-forum vendor base. The vendor markets the current build as Windows-only but has publicly stated a Linux/Debian-targeting port is in development, indicating planned cross-platform expansion. No CVE, live-captured sample, or confirmed victim telemetry is available at time of publication; this record documents builder/panel capability as analyzed by Varonis (senior threat researcher Daniel Kelley, quoted as calling it probably one of the biggest stealers he has seen, covering the biggest attack surface), not observed in-the-wild exploitation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.002 GUI Input Capture; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.006 Timestomp

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Command and Control

T1071 Application Layer Protocol; T1090.002 External Proxy

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

execution

T1106 Native API

Impact

T1498 Network Denial of Service

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

Privilege Escalation

T1547.001 Registry Run Keys / Startup Folder; T1548.002 Bypass User Account Control

privilege-escalation

T1548.002 Bypass User Account Control

Initial Access

T1566 Phishing

Execution

T1569 System Services

Resource Development

T1583.004 Server; T1587.001 Malware

defense-impairment

T1685 Disable or Modify Tools

Remediation for Dolphin X MaaS stealer

Immediate actions

• Block and monitor DNS/network traffic to thedolphinx[.]top and backend.thedolphinx[.]top:8443
• Hunt for explorer.exe processes running under a non-default desktop (HVNC indicator)
• Alert on AMSI/ETW provider tampering and direct syscall invocation patterns from unsigned or newly-dropped binaries
• Search endpoints for the published SHA-256 sample hash across EDR/AV telemetry
• Rotate credentials and revoke sessions/tokens for any host showing DPAPI mass-decryption activity against browser credential stores

Workarounds

• Restrict browser password-manager auto-fill/local storage of credentials on high-value endpoints (finance, DevOps, crypto-handling roles)
• Disable or tightly scope Windows Script Host / LOLBins commonly abused for stealer persistence and UAC bypass on standard user workstations

Longer-term hardening

• Move long-lived credentials, API keys, and cloud tokens out of on-disk project directories and .env files into a managed secrets vault
• Enforce hardware-backed or short-lived cloud CLI/DevOps tokens instead of static long-lived tokens
• Deploy EDR behavioral detection focused on process/registry/scheduled-task persistence and UAC-bypass technique families rather than static file signatures, since the malware's mutation engine defeats hash- and YARA-based detection
• Require MFA and hardware security keys for password manager and crypto wallet access to blunt credential-theft impact
• Baseline and alert on outbound SOCKS5 reverse-proxy connections from endpoints

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11
• Multiple — Chromium/Gecko-based web browsers
  Vulnerable versions: all versions storing DPAPI-protected local credential stores
• MetaMask — MetaMask browser extension wallet
  Vulnerable versions: all versions with locally-stored vault/keystore
• Exodus — Exodus desktop crypto wallet
  Vulnerable versions: all versions with locally-stored wallet data
• Multiple — Password manager desktop/browser clients (10 supported)
  Vulnerable versions: locally-cached vault data
• Multiple — Cloud provider CLI tools (30+ supported, e.g. AWS/Azure/GCP-style credential files)
  Vulnerable versions: local credential/config files

Timeline of Dolphin X MaaS stealer

• 2026-07-20 Varonis Threat Labs (senior threat researcher locked-ioc-17) obtains access to the locked-ioc-20 builder and operator panel for analysis.
• 2026-07-21 Varonis completes technical analysis of the three-tier mutation engine, AMSI/locked-ioc-18, direct-syscall evasion, the eight launcher-host UAC-bypass techniques, and the AI Profiler victim-scoring feature.
• 2026-07-21 Varonis completes analysis of the server-side build pipeline at locked-ioc-10, documenting that binaries are compiled and mutated entirely server-side rather than on the operator's machine.
• 2026-07-21 At least two confirmed locked-ioc-20 sales transactions with positive buyer feedback are logged on the forum thread as of July 21, 2026, per Varonis's monitoring.
• 2026-07-21 As of Tuesday, July 21, 2026, the locked-ioc-20 sales thread on a cybercrime forum surpasses 3,000 views under vendor alias "locked-ioc-19."
• 2026-07-22 TL-Intel Harness ingests the report via RSS hunt phase and opens threat record TL-2026-1621 for tracking; no CVE, live sample, or confirmed victim telemetry available at ingestion time.
• 2026-07-22 The Register publishes coverage of the Varonis findings at 14:00 UTC on Wednesday, July 22, 2026, quoting locked-ioc-17 calling locked-ioc-20 "probably one of the biggest stealers" he has seen and noting a Linux/Debian port is stated to be in development.
• 2026-07-22 Varonis Threat Labs publishes "locked-ioc-14" analysis on varonis.com/blog, cataloging 329 features across 10 functional categories and including the identified SHA-256 sample hash and locked-ioc-15 infrastructure.

Sources cited for Dolphin X MaaS stealer

• Dolphin X Stealer varonis.com · Research · 2026-07-22
• StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them Microsoft · Vendor report · 2026-06-24
• A Quiet "Storm": Infostealer Hijacks Sessions, Decrypts Server-Side varonis.com · Research · 2026-07-01
• Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits The Register · News · 2026-07-22
• Storm Infostealer Sold as Service, Targets Browsers, Wallets and Accounts hackread.com · News · 2026-07-01

Threats related to Dolphin X MaaS stealer

• Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications
• Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel
• Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims
• ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
• Cross-Platform Node.js NPM Stealer — Browser Credentials, Sensitive File Exfiltration, and WebSocket Reverse Shell (SHA256 049300aa…ddeb9, C2 216.126.225.243)

Related coverage of this activity

• OkoBot SeedHunter wallet phishing
• ACR Stealer WebDAV ClickFix chain
• CrashStealer Werkbit Setup lure

Previous and next in malware

• Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugal Previous report
• "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platform Next report