# Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims

> Varonis Threat Labs uncovered Dolphin X, a Windows infostealer and RAT advertised by the vendor "Kontraktnik" on a cybercrime forum, that targets 300+ applications (browsers, crypto wallets, password managers, cloud CLI tools, SSH keys, .env files) and includes a built-in AI Profiler that scores and ranks infected machines to help operators triage which victims are most valuable. A remote, server-side build and multi-tier mutation engine continuously alters compiled binaries to evade signature-based detection.

- **Published:** 2026-07-24T00:00:00Z
- **Last reviewed:** 2026-07-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1672
- **ID:** TL-2026-1672
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kontraktnik
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Dolphin X is a Windows-based information stealer and remote access trojan (RAT) first publicly disclosed by Varonis Threat Labs on 2026-07-22/23 and advertised on a cybercrime forum by a vendor operating under the alias "Kontraktnik." Varonis analyzed the malware builder, the operator/command panel, and observed network traffic in an isolated lab; no live-infection sample was examined, and the underlying binary loader was not fully reverse engineered by the time of publication.

The stealer's headline capability is an integrated "AI Profiler": after exfiltrating data, the panel automatically scores each infected host using signals such as installed software, browsing activity, and application usage, then generates ranked daily summaries. This lets an operator managing thousands of simultaneous infections quickly triage which machines belong to developers, cryptocurrency holders, or otherwise carry high-value access, rather than manually sifting through raw stealer logs.

Dolphin X targets more than 300 applications across ten panel categories, including 9 Chromium- and Gecko-based browsers, 100+ cryptocurrency wallet browser extensions, 65 desktop cryptocurrency wallets (including MetaMask via PBKDF2-derived key extraction and Exodus via Windows DPAPI abuse), 10 password managers, and 30+ cloud CLI tools, alongside SSH private keys and .env files carrying DevOps and cloud secrets. Varonis researcher Daniel Kelley characterized it as "probably one of the biggest stealers" the team has analyzed by target-application breadth. Because the stealer explicitly hunts SSH keys, cloud CLI tokens, and .env DevOps credentials, an infection on a single developer workstation can cascade into full production-environment compromise.

Delivery is not fully documented in public reporting, but the build model is notable: rather than compiling payloads locally, the operator submits a build configuration to a vendor-controlled backend (backend.thedolphinx[.]top:8443), which compiles the binary server-side. This keeps mutation and obfuscation logic under vendor control and lets Kontraktnik gate stronger evasion behind paid tiers. An opt-in, three-tier mutation engine progressively adds: (1) control-flow rewriting, instruction substitution, and re-encryption of embedded strings with a fresh key per build; (2) import-table shuffling to change the import hash between builds; and (3) PE timestamp rewriting, Rich header modification, and section padding alteration — explicitly marketed to defeat YARA rules and hash-based blocklists.

Beyond credential theft, the panel advertises the payload can also function as a Hidden VNC (HVNC) tool, a DDoS botnet node, and a generic loader. Persistence is achieved via Registry Run keys/Startup folder entries and Scheduled Tasks. Reported defense-evasion behavior includes AMSI/ETW patching, direct syscalls to bypass user-mode API hooking, eight distinct UAC-bypass methods, and process injection into browser/wallet processes to intercept in-memory credential material. Collected data (browser-stored passwords via DPAPI decryption, password-manager vaults, wallet files, SSH keys, .env secrets, cloud tokens) is bundled into a single archive for exfiltration. The malware also supports a SOCKS5 reverse-proxy C2 channel for interactive access to compromised hosts.

Commercially, Dolphin X is sold as malware-as-a-service via monthly subscriptions (~$80/month basic, ~$230/month mid-tier) and lifetime licenses ($1,140 basic / $2,280 mid / $3,420 pro), with the mutation-engine tiers and additional features gated by plan. The vendor's forum listing had drawn 3,000+ views and at least two confirmed sales as of 2026-07-22. Indicators suggest a Russian-speaking developer: the panel supports only English and Russian, and the malware's targeting logic is reported to explicitly avoid infecting hosts geolocated to CIS (Commonwealth of Independent States) countries — a common operational-security pattern intended to avoid prosecution risk in the developer's home jurisdiction. Linux (Debian) support is advertised as in development; current builds are Windows-only.

No CVE is associated with this threat — Dolphin X is a criminal malware tool distributed and deployed via social-engineering/loader chains rather than a software vulnerability. No CISA KEV or NVD entry applies. A BeaconBeagle infrastructure-correlation check against the known C2 domain thedolphinx[.]top returned zero matches at the time of this research, indicating no prior tracked infrastructure overlap in that dataset as of this writing.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1106 Native API
- T1055 Process Injection
- T1036 Masquerading
- T1112 Modify Registry
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1090 Proxy
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service

## Sources

- [Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI](https://www.varonis.com/blog/dolphin-x-stealer)
- [In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws](https://www.securityweek.com/in-other-news-dolphin-x-ai-powered-malware-car-anti-theft-device-hack-400-linux-kernel-flaws/)
- [New Dolphin X malware uses AI to rank high-value targets](https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/)
- [Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits](https://www.theregister.com/security/2026/07/22/sneaky-windows-stealer-targets-300-apps-gives-crims-an-ai-profiler-to-maximize-profits/5275962)
- [New Dolphin X Stealer Employs AI Profiling to Prioritize Targets](https://www.infosecurity-magazine.com/news/new-dolphin-x-stealer-ai-targets/)
- [New Dolphin X infostealer uses AI to identify high-value victims](https://cyberinsider.com/new-dolphin-x-infostealer-uses-ai-to-identify-high-value-victims/)
- [New Windows Stealer Uses AI Profiling to Identify High-Value Corporate Victims](https://gbhackers.com/windows-stealer-uses-ai-profiling/)
- [Dolphin X Stealer Targets 300+ Apps With AI Victim Profiling](https://www.technadu.com/dolphin-x-new-windows-stealer-uses-ai-to-rank-which-victims-are-worth-robbing/631754/)
- [This devious malware scans over 300 apps to build an AI profile telling hackers which victims to target](https://www.techradar.com/pro/security/this-devious-malware-scans-over-300-apps-to-build-an-ai-profile-telling-hackers-which-victims-to-target)
- [Dolphin X Windows stealer uses AI to target 300 apps](https://cypro.co.uk/insights/cyber-bulletins/dolphin-x-windows-stealer-uses-ai-to-target-300-apps/)
- [Dolphin X Stealer Uses AI to Rank High-Value Victims](https://socprime.com/active-threats/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1672