Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel

Key facts for Dolphin X polymorphic mutation engine

Detection coverage for Dolphin X polymorphic mutation engine

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1695 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dolphin X — Bulk Multi-Application Credential Store Access Burst

Detects a single process reading five or more distinct browser, cryptocurrency-wallet, password-manager, SSH-key, .env, or cloud-CLI credential artifacts within a short time window. Dolphin X's credential-looter module claims 300+ application targets (9 browsers, 100+ wallet extensions, 65 desktop wallets, 10 password managers, 30 cloud CLI tools) and harvests SSH keys, .env files, and cloud tokens in a single automated sweep — this burst pattern is the primary observable footprint of that sweep.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.003, T1555.005, T1552.001, T1552.004, T1528, T1005, T1560
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval target_path=lower(TargetFilename)
| where like(target_path, "%\\login data%") OR like(target_path, "%\\cookies%") OR like(target_path, "%wallet.dat%") OR like(target_path, "%.env") OR like(target_path, "%id_rsa%") OR like(target_path, "%\\credentials%") OR like(target_path, "%aws_credentials%")
| bin _time span=2m
| stats dc(target_path) as distinct_targets, values(target_path) as targets, values(Image) as accessing_process by _time, Computer, ProcessGuid
| where distinct_targets >= 5
| sort -distinct_targets

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName has_any ("Login Data", "Cookies", "wallet.dat", ".env", "id_rsa", "credentials", "aws_credentials")
| summarize DistinctTargets=dcount(FileName), Targets=make_set(FileName), AccessingProcess=any(InitiatingProcessFileName) by bin(Timestamp, 2m), DeviceName, InitiatingProcessId
| where DistinctTargets >= 5
| project Timestamp, DeviceName, InitiatingProcessId, AccessingProcess, DistinctTargets, Targets
| order by DistinctTargets desc

Sigma

title: Bulk Multi-Application Credential Store Access Burst (Dolphin X Pattern)
id: a1c93e42-7f08-4b1a-9d3e-1a2b3c4d5e6f
status: experimental
description: Detects a single process reading five or more distinct browser/wallet/password-manager/cloud-CLI credential artifacts within a short time window, consistent with Dolphin X's 300+-application credential-looter module.
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-25
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1555.005
    - attack.t1552.001
    - attack.t1552.004
    - attack.t1528
    - attack.tool.dolphin_x
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - 'Login Data'
            - 'Cookies'
            - 'wallet.dat'
            - '.env'
            - 'id_rsa'
            - 'credentials'
            - 'aws_credentials'
    timeframe: 2m
    condition: selection | count(TargetFilename) by Image >= 5
falsepositives:
    - Backup/sync software (e.g. cloud backup agents) enumerating user profile directories
    - Endpoint migration or profile-transfer tools
    - Security/IR tooling performing legitimate triage collection
level: high

Known false positives:

• Backup/sync software (e.g. cloud backup agents) enumerating user profile directories
• Endpoint migration or profile-transfer tools
• Security/IR tooling performing legitimate triage collection

Tuning notes: Raise or lower the distinct_targets/count threshold (default 5) based on observed baseline for legitimate backup/EDR agents; allowlist known-good process hashes/signers for IT-managed migration tools; narrow the file-path list to your environment's actual browser/wallet/password-manager install paths to reduce noise.

• 🔒 Dolphin X — AI-Profiler Discovery Correlated With SSH Key / .env Secret Access · unlock with TL Creds
• 🔒 Dolphin X — Chained UAC-Bypass Launcher Activity · unlock with TL Creds
• 🔒 Dolphin X — Explorer.exe Spawned Under Non-Default Desktop (HVNC Indicator) · unlock with TL Creds
• 🔒 Dolphin X — Bulk Cryptocurrency Wallet Extension / Password Manager Vault Access · unlock with TL Creds
• 🔒 Dolphin X — In-Memory AmsiScanBuffer Patch and ETW Provider Tamper Attempt · unlock with TL Creds
• 🔒 Dolphin X — SOCKS5 Proxy Tunnel Established From Unexpected Parent Process · unlock with TL Creds
• 🔒 Dolphin X — Registry Run-Key Persistence Paired With One-Time Scheduled Task · unlock with TL Creds
• 🔒 Dolphin X — Egress to Backend Build/Licensing Endpoint Followed by New Executable Drop · unlock with TL Creds

Indicators of compromise for Dolphin X polymorphic mutation engine

As of 2026-07-22, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-1695.

Sample indicators (2 of 17)

• Domain: thedolphinx[.]top
• File hash: 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How Dolphin X polymorphic mutation engine works

Its 329-feature operator panel includes an AI behavioral profiler that risk-scores victims to flag high-value hosts (cloud CLI, IDE, admin-console access) for follow-on exploitation, plus an opt-in three-tier polymorphic build-mutation engine and multiple defense-evasion techniques (AMSI/ETW patching, direct syscalls, UAC bypass) for detection evasion.

Dolphin X is a Windows-focused credential-stealer, remote access trojan, Hidden-VNC (HVNC) tool, DDoS-capable botnet client, and secondary-payload loader offered as a subscription malware-as-a-service (MaaS) product. It is advertised on a cybercrime forum by a vendor using the handle "Kontraktnik," who markets it as an all-in-one stealer/RAT with 329 discrete features spread across ten operator-panel categories. Varonis Threat Labs researcher Daniel Kelley obtained access to the operator panel, builder, and its network traffic in an isolated lab and published the first technical analysis on 2026-07-22; broader trade-press coverage followed on 2026-07-22/23 (The Register, GBHackers, BleepingComputer, Hackread, CyberInsider, SOCPrime, Infosecurity Magazine).

The credential-looter module alone claims over 300 application targets: nine Chromium/Gecko browsers, more than 100 cryptocurrency wallet browser extensions, 65 desktop cryptocurrency wallets, 10 password managers, and 30 cloud command-line tools, plus generic theft of SSH private keys, `.env` files, and cloud/DevOps access tokens.

The operator panel's standout feature is an "AI Profiler" (panel strings include `Auto-Start AI Profiler`, `ProfilerStart`, `ProfilerGetData`, `risk_score`, `risk_factors`, `categoryusage`) that tracks victim application usage, browsing activity, and installed software to compute a per-victim risk score and deliver daily-ranked summaries to the operator. This lets an attacker running a large botnet skip manual triage and jump straight to hosts flagged as developer workstations, cryptocurrency holders, or other high-value targets with cloud CLI, IDE, or admin-console access. Varonis could not determine what underlying AI/ML engine drives the scoring without a live malware sample, since analysis was limited to the panel and builder.

Evasion is delivered through an opt-in, disabled-by-default, three-tier polymorphic mutation engine gated by subscription level: the basic tier rewrites PE timestamps, the Rich header, and section padding to defeat brittle YARA rules and hash blocklists; the mid tier additionally shuffles the import table to change the binary's import hash between builds; the top (Pro) tier adds control-flow rewriting, instruction substitution, and re-encryption of embedded strings with a fresh key per build to defeat stable byte-sequence signatures. Builds are not compiled locally — operators configure C2 endpoint, install path, persistence, and evasion options in a desktop client, submit the configuration to `backend.thedolphinx.top:8443`, and the vendor's backend compiles and returns the finished Windows executable, letting the vendor mutate every sample before delivery.

Additional documented capabilities include Hidden-VNC (HVNC) hands-on-keyboard remote access (observable as `explorer.exe` instances running under non-default desktops), a DDoS botnet function, and a loader function for staging secondary payloads. Defense-evasion and privilege-escalation features include AMSI bypass via in-memory patching of `AmsiScanBuffer`, ETW patching, direct syscalls to bypass user-mode API hooks, and eight distinct launcher-host UAC-bypass techniques. Persistence is achieved via registry Run keys/Startup folder or scheduled tasks, and C2/egress traffic can be tunneled through a built-in SOCKS5 proxy.

Pricing is tiered: monthly subscriptions run roughly $80 (basic) to $230 (mid), with lifetime options at $1,140 (basic), $2,280 (mid), and $3,420 (Pro); the Pro tier is required to unlock the top mutation tier. The panel supports English and Russian, and includes a built-in option to exclude CIS-country systems from infection — a common feature in Russian-speaking cybercrime tooling used to avoid domestic law-enforcement attention. As of the July 2026 reporting window, the forum listing had accrued 3,000+ views and at least two confirmed sales with positive buyer feedback; Linux/Debian support is advertised as planned but not yet shipped.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Discovery

T1010 Application Window Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Execution

T1106 Native API

Impact

T1498 Network Denial of Service

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

defense-impairment

T1685 Disable or Modify Tools

Remediation for Dolphin X polymorphic mutation engine

Immediate actions

• Block/sinkhole DNS and egress to thedolphinx.top and backend.thedolphinx.top:8443 at the perimeter and via DNS security controls
• Hunt for explorer.exe processes running under non-default desktops, a behavioral indicator of Dolphin X's HVNC hidden-desktop remote-control activity
• Isolate and rebuild (do not just clean) any host suspected of Dolphin X infection given the DDoS/loader/HVNC capabilities
• Rotate all credentials reachable from a suspected host: browser-saved passwords, password-manager vaults, cryptocurrency wallet keys, SSH private keys, cloud CLI/API tokens, and secrets in .env files

Workarounds

• Restrict outbound TCP/8443 to known-good destinations to disrupt the vendor's licensing/telemetry/remote-build channel
• Enable browser and password-manager extension allowlisting/hardening to reduce the attack surface for the 100+ wallet extensions and 10 password managers Dolphin X targets

Longer-term hardening

• Shift endpoint detection from static hash/signature matching to behavioral analytics, since the built-in polymorphic mutation engine is designed specifically to defeat hash blocklists and brittle YARA rules
• Instrument EDR for AMSI/ETW-tamper detection (in-memory AmsiScanBuffer patching, ETW patching) and anomalous direct-syscall usage
• Eliminate long-lived plaintext credentials from disk, especially SSH keys and secrets stored in project directories (.env files), which Dolphin X specifically targets
• Move cloud/DevOps authentication to short-lived, scoped tokens instead of long-lived static CLI credentials to reduce blast radius if a developer workstation is compromised
• Enforce application allowlisting and restrict local admin rights to reduce the impact of the malware's eight documented UAC-bypass techniques

Affected and fixed versions

• Microsoft — Windows (desktop and server)
  Vulnerable versions: Windows 10; Windows 11; Windows Server 2016-2022
• Various — Web browsers (9 Chromium/Gecko-based browsers targeted)
  Vulnerable versions: all versions with stored credentials
• Various — Cryptocurrency wallet browser extensions (100+ targeted)
  Vulnerable versions: all
• Various — Desktop cryptocurrency wallets (65 targeted)
  Vulnerable versions: all
• Various — Password managers (10 targeted)
  Vulnerable versions: all
• Various — Cloud CLI tools (30+ targeted, e.g. AWS/Azure/GCP CLIs)
  Vulnerable versions: all

Timeline of Dolphin X polymorphic mutation engine

• 2026-07-22 The Register publishes "Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits," the first same-day trade-press pickup of the Varonis findings.
• 2026-07-22 locked-ioc-16's cybercrime-forum listing for locked-ioc-17 is observed by Varonis with 3,000+ views and at least two confirmed sales with positive buyer feedback as of the reporting window, indicating the listing predates the public research by an unspecified interval.
• 2026-07-22 Varonis Threat Labs researcher Daniel Kelley publishes the primary technical analysis of locked-ioc-17 ("locked-ioc-17 Stealer Targets 300+ Apps and Profiles Users with AI") after obtaining access to the operator panel, builder, and network traffic in an isolated lab environment; the analysis is the sourcing basis for every subsequent trade-press article.
• 2026-07-23 Cyber Security News's Tushar Subhra Dutta publishes "New locked-ioc-17 Malware Steals Credentials From 300+ Apps and Profiles Victims With AI," independently tabulating the published IOCs (locked-ioc-14, locked-ioc-11:8443, and the panel-client SHA-256) and proposing supplementary MITRE ATT&CK mappings for the profiler/persistence behaviors.
• 2026-07-23 Infosecurity Magazine publishes "New locked-ioc-17 Stealer Employs AI Profiling to Prioritize Targets," reiterating defender guidance to avoid long-lived local credentials and prioritize behavioral over signature-based detection.
• 2026-07-23 CyberInsider's Amar Ćemanović publishes "New locked-ioc-17 infostealer uses AI to identify high-value victims," covering the server-side mutation engine and cloud-based build system.
• 2026-07-23 GBHackers publishes "Windows Stealer Uses AI Profiling to Score Victims and Prioritize High-Value Targets," the source feed article that triggered this hunt.
• 2026-07-23 SOC Prime republishes the Varonis findings as an active-threat bulletin, adding detection-engineering guidance: prioritize behavioral detection over file-based signatures, harden access controls on cloud consoles/build pipelines, and hunt for explorer.exe running under non-default desktops.
• 2026-07-23 BleepingComputer's Lawrence Abrams publishes "New locked-ioc-17 malware uses AI to rank high-value targets" at 5:20 PM ET, reporting on the 329-feature operator panel, credential-theft scope, and defense-evasion techniques (AMSI/locked-ioc-15, direct syscalls, UAC bypass).
• 2026-07-24 Hackread's Waqas publishes "New locked-ioc-17 Malware Uses AI Profiler to Rank High-Value Victims," the last dated wave of independent trade-press pickup, describing the paid mutation options as a hash-based-detection evasion mechanism.
• 2026-07-25 TL-Intel-Harness RESEARCH phase completes deep-dive analysis, MITRE ATT&CK mapping, and IOC extraction for TL-2026-1695.

Sources cited for Dolphin X polymorphic mutation engine

• Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI varonis.com · Research · 2026-07-22
• Dolphin X Stealer Uses AI to Rank High-Value Victims socprime.com · Research · 2026-07-23
• Windows Stealer Uses AI Profiling to Score Victims and Prioritize High-Value Targets gbhackers.com · Blog · 2026-07-23
• New Dolphin X malware uses AI to rank high-value targets BleepingComputer · News · 2026-07-23
• Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits The Register · News · 2026-07-22
• New Dolphin X Malware Uses AI Profiler to Rank High-Value Victims hackread.com · News · 2026-07-23
• New Dolphin X infostealer uses AI to identify high-value victims cyberinsider.com · News · 2026-07-23
• New Dolphin X Stealer Employs AI Profiling to Prioritize Targets infosecurity-magazine.com · News · 2026-07-23
• New Dolphin X Malware Steals Credentials From 300+ Apps and Profiles Victims With AI cybersecuritynews.com · News · 2026-07-23

Threats related to Dolphin X polymorphic mutation engine

• Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims
• Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx[.]top)
• Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications
• PureLog Stealer Multi-Stage Fileless Campaign Using Copyright Infringement Lures
• The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm

Related coverage of this activity

• MedusaHVNC AMSI/ETW hidden desktop

Previous and next in malware

• Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign) Previous report
• TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in) Next report