Threat reportMalwareTL-2026-1672
Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims
Dolphin X: AI-Powered Windows Infostealer/RAT Uses (TL-2026-1672), also tracked as Dolphin X Stealer, is a high-severity malware campaign, first published 2026-07-24. It is attributed to Kontraktnik with low confidence, affects Microsoft Windows (all supported desktop/workstation versions), maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 1Kontraktnik
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-1672
- Threat ID
- TL-2026-1672
- Also known as
- Dolphin X Stealer, DolphinX
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Kontraktnik
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, finance, cryptocurrency, managedserviceproviders, cloudservices
- Target regions
- Global, North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Dolphin X: AI-Powered Windows Infostealer/RAT Uses
Malware and tooling: Dolphin X, Dolphin X Stealer, Dolphin X Operator Panel, SOCKS5 reverse-proxy channel
How Dolphin X: AI-Powered Windows Infostealer/RAT Uses works
Varonis Threat Labs uncovered Dolphin X, a Windows infostealer and RAT advertised by the vendor "Kontraktnik" on a cybercrime forum, that targets 300+ applications (browsers, crypto wallets, password managers, cloud CLI tools, SSH keys, .env files) and includes a built-in AI Profiler that scores and ranks infected machines to help operators triage which victims are most valuable. A remote, server-side build and multi-tier mutation engine continuously alters compiled binaries to evade signature-based detection.
Dolphin X is a Windows-based information stealer and remote access trojan (RAT) first publicly disclosed by Varonis Threat Labs on 2026-07-22/23 and advertised on a cybercrime forum by a vendor operating under the alias "Kontraktnik." Varonis analyzed the malware builder, the operator/command panel, and observed network traffic in an isolated lab; no live-infection sample was examined, and the underlying binary loader was not fully reverse engineered by the time of publication.
The stealer's headline capability is an integrated "AI Profiler": after exfiltrating data, the panel automatically scores each infected host using signals such as installed software, browsing activity, and application usage, then generates ranked daily summaries. This lets an operator managing thousands of simultaneous infections quickly triage which machines belong to developers, cryptocurrency holders, or otherwise carry high-value access, rather than manually sifting through raw stealer logs.
Dolphin X targets more than 300 applications across ten panel categories, including 9 Chromium- and Gecko-based browsers, 100+ cryptocurrency wallet browser extensions, 65 desktop cryptocurrency wallets (including MetaMask via PBKDF2-derived key extraction and Exodus via Windows DPAPI abuse), 10 password managers, and 30+ cloud CLI tools, alongside SSH private keys and .env files carrying DevOps and cloud secrets. Varonis researcher Daniel Kelley characterized it as "probably one of the biggest stealers" the team has analyzed by target-application breadth. Because the stealer explicitly hunts SSH keys, cloud CLI tokens, and .env DevOps credentials, an infection on a single developer workstation can cascade into full production-environment compromise.
Delivery is not fully documented in public reporting, but the build model is notable: rather than compiling payloads locally, the operator submits a build configuration to a vendor-controlled backend (backend.thedolphinx[.]top:8443), which compiles the binary server-side. This keeps mutation and obfuscation logic under vendor control and lets Kontraktnik gate stronger evasion behind paid tiers. An opt-in, three-tier mutation engine progressively adds: (1) control-flow rewriting, instruction substitution, and re-encryption of embedded strings with a fresh key per build; (2) import-table shuffling to change the import hash between builds; and (3) PE timestamp rewriting, Rich header modification, and section padding alteration — explicitly marketed to defeat YARA rules and hash-based blocklists.
Beyond credential theft, the panel advertises the payload can also function as a Hidden VNC (HVNC) tool, a DDoS botnet node, and a generic loader. Persistence is achieved via Registry Run keys/Startup folder entries and Scheduled Tasks. Reported defense-evasion behavior includes AMSI/ETW patching, direct syscalls to bypass user-mode API hooking, eight distinct UAC-bypass methods, and process injection into browser/wallet processes to intercept in-memory credential material. Collected data (browser-stored passwords via DPAPI decryption, password-manager vaults, wallet files, SSH keys, .env secrets, cloud tokens) is bundled into a single archive for exfiltration. The malware also supports a SOCKS5 reverse-proxy C2 channel for interactive access to compromised hosts.
Commercially, Dolphin X is sold as malware-as-a-service via monthly subscriptions (~$80/month basic, ~$230/month mid-tier) and lifetime licenses ($1,140 basic / $2,280 mid / $3,420 pro), with the mutation-engine tiers and additional features gated by plan. The vendor's forum listing had drawn 3,000+ views and at least two confirmed sales as of 2026-07-22. Indicators suggest a Russian-speaking developer: the panel supports only English and Russian, and the malware's targeting logic is reported to explicitly avoid infecting hosts geolocated to CIS (Commonwealth of Independent States) countries — a common operational-security pattern intended to avoid prosecution risk in the developer's home jurisdiction. Linux (Debian) support is advertised as in development; current builds are Windows-only.
No CVE is associated with this threat — Dolphin X is a criminal malware tool distributed and deployed via social-engineering/loader chains rather than a software vulnerability. No CISA KEV or NVD entry applies. A BeaconBeagle infrastructure-correlation check against the known C2 domain thedolphinx[.]top returned zero matches at the time of this research, indicating no prior tracked infrastructure overlap in that dataset as of this writing.
MITRE ATT&CK techniques used in TL-2026-1672
Collection
T1005 Data from Local System; T1119 Automated Collection; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
execution
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Impact
T1498 Network Denial of Service
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
Affected products and versions in Dolphin X: AI-Powered Windows Infostealer/RAT Uses
- Microsoft — Windows (all supported desktop/workstation versions)
Vulnerable versions: Windows 10; Windows 11 - Various — Chromium and Gecko-based web browsers (9 targeted)
Vulnerable versions: all versions storing credentials via browser DPAPI/profile storage - Various — Cryptocurrency wallet extensions and desktop wallets (165+ targeted, incl. MetaMask, Exodus)
Vulnerable versions: all versions using local key/vault storage - Various — Password managers (10 targeted)
Vulnerable versions: all versions with locally cached/decryptable vaults - Various — Cloud CLI tools (30+ targeted, e.g. AWS CLI, Azure CLI, GCP CLI credential stores)
Vulnerable versions: all versions storing local session/config credentials
Remediation for Dolphin X: AI-Powered Windows Infostealer/RAT Uses
Immediate actions
- Rotate all credentials, SSH keys, and cloud/DevOps tokens on any host suspected of Dolphin X infection
- Audit cloud console and CI/CD/build-pipeline access logs for unauthorized activity originating from developer workstations
- Block outbound connections to thedolphinx[.]top and backend.thedolphinx[.]top:8443 at perimeter/DNS/proxy layer
- Isolate and forensically image any endpoint exhibiting unexpected explorer.exe instances running under non-default desktops (HVNC indicator)
Workarounds
- Restrict local storage of cryptocurrency wallet extensions/desktop wallets and password-manager vaults on high-privilege developer machines where feasible
- Segment developer/build infrastructure from production so a single compromised workstation cannot directly pivot into production environments
Longer-term hardening
- Prioritize behavioral/EDR-based detection over static file-hash or YARA signatures given the built-in multi-tier binary mutation engine
- Remove long-lived plaintext credentials, SSH keys, and .env secrets from developer workstations and local project directories; migrate to short-lived tokens and secrets managers
- Enforce hardware-backed MFA and conditional access for cloud consoles, CLI tools, and Git/DevOps platforms so a stolen static token alone cannot grant access
- Deploy application allowlisting and script-execution controls on developer endpoints given the broad 300+ application targeting scope
- Monitor for AMSI/ETW tampering, direct syscall usage, and anomalous UAC-bypass activity via EDR telemetry
Timeline of Dolphin X: AI-Powered Windows Infostealer/RAT Uses
- Infosecurity Magazine, CyberInsider, GBHackers, TechNadu, TechRadar, and Cypro publish further coverage summarizing the Dolphin X AI-profiling and credential-theft capabilities.
- BleepingComputer and The Register publish coverage of the Varonis findings, quoting Varonis researcher Daniel Kelley describing Dolphin X as 'probably one of the biggest stealers' the team has analyzed by target-application breadth.
- Varonis documents the Dolphin X malware-as-a-service pricing model: free/basic tier ships with the binary mutation engine disabled by default; a paid PRO plan unlocks mutation tiers 2 and 3; subscription pricing runs ~$80/month (basic) to ~$230/month (mid-tier), with lifetime licenses of $1,140/$2,280/$3,420.
- Vendor forum listing for Dolphin X reaches 3,000+ views with at least two confirmed sales reported by researchers.
- Varonis Threat Labs publishes analysis of the Dolphin X stealer builder, operator panel binary (SHA-256 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be), and observed network traffic in an isolated lab; identifies vendor alias 'Kontraktnik' and the AI Profiler capability; maps 16 MITRE ATT&CK techniques including T1555.003, T1552.001, T1055, and T1027.
- SOCPrime publishes a detection-focused summary referencing five available detection rules: suspicious DNS requests via unusual TLDs, SHA-256 IOC hash matching, credential-targeting/security-tool-modification behavior (Windows Security Event Log), Dolphin X technique detection (Windows Process Creation), and Registry Run Key/Startup Folder persistence.
- SecurityWeek includes Dolphin X in its 'In Other News' roundup alongside unrelated automotive Bluetooth-key and Linux kernel disclosures.
- TL-Intel Harness RESEARCH phase compiles a consolidated threat intelligence record for TL-2026-1672 from open-source reporting; a BeaconBeagle correlation check against thedolphinx[.]top returns no matches.
Sources cited for Dolphin X: AI-Powered Windows Infostealer/RAT Uses
- Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI
- In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws
- New Dolphin X malware uses AI to rank high-value targets
- Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits
- New Dolphin X Stealer Employs AI Profiling to Prioritize Targets
- New Dolphin X infostealer uses AI to identify high-value victims
- New Windows Stealer Uses AI Profiling to Identify High-Value Corporate Victims
- Dolphin X Stealer Targets 300+ Apps With AI Victim Profiling
- This devious malware scans over 300 apps to build an AI profile telling hackers which victims to target
- Dolphin X Windows stealer uses AI to target 300 apps
- Dolphin X Stealer Uses AI to Rank High-Value Victims
Detection coverage for TL-2026-1672
As of 2026-07-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1672 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.