# Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx[.]top)

> Dolphin X is a Windows infostealer sold as malware-as-a-service on cybercrime forums by vendor "Kontraktnik," targeting 300+ applications (browsers, password managers, crypto wallets, SSH keys, .env files, cloud CLI tokens, DevOps secrets) and offering stealer/HVNC/loader/DDoS-botnet functionality behind a server-side build system. Its standout feature is an AI behavioral profiler that scores infected victims by app usage and browsing history and pushes operators a daily ranked-by-payoff summary.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1621
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-dolphin-x-maas-stealer-tl-2026-1621.webp?v=5a74b81c (Threadlinqs threat intel: Dolphin X Stealer Sold by Kontraktnik: Detection & IOCs (TL-2026-1621) — High severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-1621
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kontraktnik
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (2 shown free below)

## Description

Varonis Threat Labs (analyst Daniel Kelley) obtained access to the Dolphin X builder and operator panel — not a live sample — after the tool appeared for sale on a cybercrime forum under the alias "Kontraktnik," with the sales thread exceeding 3,000 views and at least two confirmed deals with positive vendor feedback as of the report. Dolphin X is a Windows-only .NET/native hybrid stealer (Debian-based operator tooling claimed by the vendor) marketed with the pitch "you can use it as a stealer, as an HVNC, as a DDoS botnet, as a loader," positioning it as a multi-purpose access-and-monetization platform rather than a single-purpose credential grabber.

The build pipeline is fully server-side: the operator configures the agent's C2 address, install path, persistence method, and evasion tier inside the panel, and the client submits that configuration to backend.thedolphinx[.]top:8443, where the binary is compiled and mutated before delivery. Nothing compiles on the operator's own machine, which both lowers the bar for less technical affiliates and complicates static-signature tracking since every build can be uniquely mutated server-side.

Collection scope spans nine Chromium/Gecko browsers, 100+ browser wallet extensions (including MetaMask), 65 desktop wallet applications (including Exodus), 10 password managers, and 30+ cloud CLI tools, in addition to SSH private keys, .env files, and general DevOps secrets — consolidated into a single exfiltration archive per victim. Browser credential theft relies on DPAPI decryption of locally stored secrets.

Defense evasion is built around a three-tier mutation engine (default disabled, top tier gated behind the PRO pricing plan): Tier 1 rewrites control flow, substitutes instructions, and re-encrypts embedded strings with a random per-build key; Tier 2 adds import-table shuffling; Tier 3 rewrites the PE timestamp, Rich header, and section padding. The malware also performs AMSI and ETW patching and issues direct syscalls to bypass user-mode API hooks, and exfiltrates over a SOCKS5 reverse-proxy channel. Persistence is achieved via Registry Run keys, the Windows Startup folder, or scheduled tasks, and the builder offers eight distinct launcher-host UAC bypass techniques for privilege escalation. Varonis notes that explorer.exe running under a non-default desktop is a strong host indicator of an active HVNC session.

The AI Profiler is the differentiating feature: rather than dumping raw stolen data on the operator, it applies a behavioral-scoring model against installed software, app usage patterns, and browsing history to rank victims by likely monetary payoff, then delivers a daily digest so lower-skilled affiliates can triage which infections to work first — effectively industrializing post-compromise victim selection for a MaaS customer base.

Pricing is tiered: Basic at roughly $80/month or $1,140 lifetime, Mid at roughly $230/month or $2,280 lifetime, and Pro at roughly $3,420 lifetime (Pro unlocking the full three-tier mutation engine; no monthly Pro rate was disclosed in reporting). Varonis catalogs the tool's total feature set at 329 discrete features organized across 10 functional categories. The tool includes a CIS-country infection-avoidance option and ships with English and Russian language support, both patterns consistent with a Russian-speaking cybercrime-forum vendor base. The vendor markets the current build as Windows-only but has publicly stated a Linux/Debian-targeting port is in development, indicating planned cross-platform expansion. No CVE, live-captured sample, or confirmed victim telemetry is available at time of publication; this record documents builder/panel capability as analyzed by Varonis (senior threat researcher Daniel Kelley, quoted as calling it probably one of the biggest stealers he has seen, covering the biggest attack surface), not observed in-the-wild exploitation.

## MITRE ATT&CK

- T1566 Phishing
- T1569 System Services
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1106 Native API
- T1055 Process Injection
- T1548.002 Bypass User Account Control
- T1070.006 Timestomp
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1518 Software Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1056.002 GUI Input Capture
- T1090.002 External Proxy
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service
- T1587.001 Malware
- T1583.004 Server

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dolphin X — Mass Browser Credential Store (DPAPI) Access, Wallet/SSH/.env Enumeration, and Archive Consolidation** (`TL-2026-1621-SPL-002`)

Detects the post-exploitation collection chain: rapid enumeration/read access to browser DPAPI-protected credential stores, crypto wallet files (MetaMask/Exodus), SSH keys, .env files, and cloud CLI credential files, followed by consolidation into a single archive — the signature Dolphin X 'single exfil bundle per victim' pattern.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1552.001, T1555, T1528, T1005, T1560
- **Data sources:** sysmon, windows_security, edr_file_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval fname=lower(TargetFilename)
| where like(fname, "%login data%") OR like(fname, "%cookies%") OR like(fname, "%key4.db%") OR like(fname, "%.env%") OR like(fname, "%id_rsa%") OR like(fname, "%metamask%") OR like(fname, "%exodus%") OR like(fname, "%\\.aws\\credentials%")
| bin _time span=5m
| stats dc(fname) as unique_targets values(fname) as files_touched count by _time, Computer, Image, User
| where unique_targets >= 4
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      | eval fname=lower(TargetFilename)
      | where like(fname, "%.zip") OR like(fname, "%.rar") OR like(fname, "%.tar.gz")
      | stats count by Computer, Image, User, fname ]
| table _time, Computer, User, Image, unique_targets, files_touched
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName has_any ("Login Data", "Cookies", "key4.db", ".env", "id_rsa", "metamask", "exodus", "credentials")
| summarize UniqueTargets=dcount(FileName), Files=make_set(FileName), Count=count() by bin(Timestamp, 5m), DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where UniqueTargets >= 4
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName endswith ".zip" or FileName endswith ".rar" or FileName endswith ".tar.gz"
    | project ArchiveTime=Timestamp, DeviceName, ArchiveFile=FileName
) on DeviceName
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, UniqueTargets, Files, ArchiveFile, ArchiveTime
```

### Sigma

```yaml
title: Mass Credential Store and Wallet/SSH/.env File Access Followed by Archive Creation (Dolphin X Collection Pattern)
id: 3a4b5c6d-1e2f-4a8b-9c0d-2e3f4a5b6c72
status: experimental
description: Detects broad enumeration of browser credential stores, crypto wallet vaults, SSH keys, and .env/cloud-CLI credential files within a short window, followed by single-archive consolidation — matching the Dolphin X stealer's collection-and-bundle behavior
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1552.001
    - attack.collection
    - attack.t1560
    - attack.t1005
    - attack.malware.dolphin_x
logsource:
    category: file_event
    product: windows
detection:
    selection_targets:
        TargetFilename|contains:
            - 'Login Data'
            - 'Cookies'
            - 'key4.db'
            - '.env'
            - 'id_rsa'
            - 'metamask'
            - 'exodus'
            - '\.aws\credentials'
    condition: selection_targets | count() by Computer, Image, User > 3
falsepositives:
    - Endpoint backup, migration, or DLP scanning tools legitimately reading these paths
    - Password manager or browser-sync utilities performing bulk profile access
level: high
```

**Known false positives:**

- Legitimate password manager sync/migration tools, endpoint backup software, DLP content-inspection scanners touching similar paths in bulk

**Tuning notes:** Tune the unique_targets threshold (currently 4) per environment baseline; exclude known-good backup/EDR agent process hashes; correlate with the C2 callout detection (SPL-001/KQL-001) for higher-confidence alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Dolphin X — Phishing-Delivered Loader Reaching Server-Side Build Backend (locked: unlock with TL Creds)
- Dolphin X — Registry Run Key / [indicator] Referencing User-Writable Path (locked: unlock with TL Creds)
- Dolphin X — AMSI/ETW Tampering and Direct Syscall Invocation from Unsigned Binary (locked: unlock with TL Creds)
- Dolphin X — Phishing-Origin Loader Executing Recently-Dropped Binary (Exploitation Stage) (locked: unlock with TL Creds)
- Dolphin X — PE Timestomp / Rich-Header Anomaly with UAC-Bypass Launcher Chain (Post-Exploitation) (locked: unlock with TL Creds)
- Dolphin X — Repeated Scheduled Task / Cron Persistence Entries With Generic Marker Names Beaconing Outbound (C2/Lateral Movement) (locked: unlock with TL Creds)
- Dolphin X — Server-Side Build Backend C2/Delivery Callout ([indicator]:8443) (locked: unlock with TL Creds)
- Dolphin X — HVNC Non-Default-Desktop Explorer.exe and SOCKS5 Reverse-Proxy Beacon (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 22)

Defanged, TLP:CLEAR.

- Domain: `thedolphinx[.]top`
- File hash: `726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits](https://www.theregister.com/security/2026/07/22/sneaky-windows-stealer-targets-300-apps-gives-crims-an-ai-profiler-to-maximize-profits/5275962)
- [Dolphin X Stealer](https://www.varonis.com/blog/dolphin-x-stealer)
- [StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them](https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/)
- [A Quiet "Storm": Infostealer Hijacks Sessions, Decrypts Server-Side](https://www.varonis.com/blog/storm-infostealer)
- [Storm Infostealer Sold as Service, Targets Browsers, Wallets and Accounts](https://hackread.com/storm-infostealer-sold-as-service-browsers-wallets/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1621