# Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel

> Dolphin X is a Windows infostealer/RAT/HVNC/DDoS-loader sold as malware-as-a-service by cybercrime-forum vendor "Kontraktnik," harvesting credentials from 300+ applications (9 browsers, 100+ wallet extensions, 65 desktop wallets, 10 password managers, 30 cloud CLI tools) plus SSH keys, .env files, and cloud tokens. Its 329-feature operator panel includes an AI behavioral profiler that risk-scores victims to flag high-value hosts (cloud CLI, IDE, admin-console access) for follow-on exploitation, plus an opt-in three-tier polymorphic build-mutation engine and multiple defense-evasion techniques (AMSI/ETW patching, direct syscalls, UAC bypass) for detection evasion.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1695
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-dolphin-x-polymorphic-mutation-engine-tl-2026-1695.webp?v=9103cfe3 (Threadlinqs threat intel: Dolphin X Polymorphic Mutation Engine: Detection & IOCs (TL-2026-1695) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-1695
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kontraktnik (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (2 shown free below)

## Description

Dolphin X is a Windows-focused credential-stealer, remote access trojan, Hidden-VNC (HVNC) tool, DDoS-capable botnet client, and secondary-payload loader offered as a subscription malware-as-a-service (MaaS) product. It is advertised on a cybercrime forum by a vendor using the handle "Kontraktnik," who markets it as an all-in-one stealer/RAT with 329 discrete features spread across ten operator-panel categories. Varonis Threat Labs researcher Daniel Kelley obtained access to the operator panel, builder, and its network traffic in an isolated lab and published the first technical analysis on 2026-07-22; broader trade-press coverage followed on 2026-07-22/23 (The Register, GBHackers, BleepingComputer, Hackread, CyberInsider, SOCPrime, Infosecurity Magazine).

The credential-looter module alone claims over 300 application targets: nine Chromium/Gecko browsers, more than 100 cryptocurrency wallet browser extensions, 65 desktop cryptocurrency wallets, 10 password managers, and 30 cloud command-line tools, plus generic theft of SSH private keys, `.env` files, and cloud/DevOps access tokens.

The operator panel's standout feature is an "AI Profiler" (panel strings include `Auto-Start AI Profiler`, `ProfilerStart`, `ProfilerGetData`, `risk_score`, `risk_factors`, `categoryusage`) that tracks victim application usage, browsing activity, and installed software to compute a per-victim risk score and deliver daily-ranked summaries to the operator. This lets an attacker running a large botnet skip manual triage and jump straight to hosts flagged as developer workstations, cryptocurrency holders, or other high-value targets with cloud CLI, IDE, or admin-console access. Varonis could not determine what underlying AI/ML engine drives the scoring without a live malware sample, since analysis was limited to the panel and builder.

Evasion is delivered through an opt-in, disabled-by-default, three-tier polymorphic mutation engine gated by subscription level: the basic tier rewrites PE timestamps, the Rich header, and section padding to defeat brittle YARA rules and hash blocklists; the mid tier additionally shuffles the import table to change the binary's import hash between builds; the top (Pro) tier adds control-flow rewriting, instruction substitution, and re-encryption of embedded strings with a fresh key per build to defeat stable byte-sequence signatures. Builds are not compiled locally — operators configure C2 endpoint, install path, persistence, and evasion options in a desktop client, submit the configuration to `backend.thedolphinx.top:8443`, and the vendor's backend compiles and returns the finished Windows executable, letting the vendor mutate every sample before delivery.

Additional documented capabilities include Hidden-VNC (HVNC) hands-on-keyboard remote access (observable as `explorer.exe` instances running under non-default desktops), a DDoS botnet function, and a loader function for staging secondary payloads. Defense-evasion and privilege-escalation features include AMSI bypass via in-memory patching of `AmsiScanBuffer`, ETW patching, direct syscalls to bypass user-mode API hooks, and eight distinct launcher-host UAC-bypass techniques. Persistence is achieved via registry Run keys/Startup folder or scheduled tasks, and C2/egress traffic can be tunneled through a built-in SOCKS5 proxy.

Pricing is tiered: monthly subscriptions run roughly $80 (basic) to $230 (mid), with lifetime options at $1,140 (basic), $2,280 (mid), and $3,420 (Pro); the Pro tier is required to unlock the top mutation tier. The panel supports English and Russian, and includes a built-in option to exclude CIS-country systems from infection — a common feature in Russian-speaking cybercrime tooling used to avoid domestic law-enforcement attention. As of the July 2026 reporting window, the forum listing had accrued 3,000+ views and at least two confirmed sales with positive buyer feedback; Linux/Debian support is advertised as planned but not yet shipped.

## MITRE ATT&CK

- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1055 Process Injection
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1518 Software Discovery
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1090 Proxy
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1498 Network Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dolphin X — Bulk Multi-Application Credential Store Access Burst** (`TL-2026-1695-SPL-001`)

Detects a single process reading five or more distinct browser, cryptocurrency-wallet, password-manager, SSH-key, .env, or cloud-CLI credential artifacts within a short time window. Dolphin X's credential-looter module claims 300+ application targets (9 browsers, 100+ wallet extensions, 65 desktop wallets, 10 password managers, 30 cloud CLI tools) and harvests SSH keys, .env files, and cloud tokens in a single automated sweep — this burst pattern is the primary observable footprint of that sweep.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1555.005, T1552.001, T1552.004, T1528, T1005, T1560
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval target_path=lower(TargetFilename)
| where like(target_path, "%\\login data%") OR like(target_path, "%\\cookies%") OR like(target_path, "%wallet.dat%") OR like(target_path, "%.env") OR like(target_path, "%id_rsa%") OR like(target_path, "%\\credentials%") OR like(target_path, "%aws_credentials%")
| bin _time span=2m
| stats dc(target_path) as distinct_targets, values(target_path) as targets, values(Image) as accessing_process by _time, Computer, ProcessGuid
| where distinct_targets >= 5
| sort -distinct_targets
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName has_any ("Login Data", "Cookies", "wallet.dat", ".env", "id_rsa", "credentials", "aws_credentials")
| summarize DistinctTargets=dcount(FileName), Targets=make_set(FileName), AccessingProcess=any(InitiatingProcessFileName) by bin(Timestamp, 2m), DeviceName, InitiatingProcessId
| where DistinctTargets >= 5
| project Timestamp, DeviceName, InitiatingProcessId, AccessingProcess, DistinctTargets, Targets
| order by DistinctTargets desc
```

### Sigma

```yaml
title: Bulk Multi-Application Credential Store Access Burst (Dolphin X Pattern)
id: a1c93e42-7f08-4b1a-9d3e-1a2b3c4d5e6f
status: experimental
description: Detects a single process reading five or more distinct browser/wallet/password-manager/cloud-CLI credential artifacts within a short time window, consistent with Dolphin X's 300+-application credential-looter module.
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-25
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1555.005
    - attack.t1552.001
    - attack.t1552.004
    - attack.t1528
    - attack.tool.dolphin_x
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - 'Login Data'
            - 'Cookies'
            - 'wallet.dat'
            - '.env'
            - 'id_rsa'
            - 'credentials'
            - 'aws_credentials'
    timeframe: 2m
    condition: selection | count(TargetFilename) by Image >= 5
falsepositives:
    - Backup/sync software (e.g. cloud backup agents) enumerating user profile directories
    - Endpoint migration or profile-transfer tools
    - Security/IR tooling performing legitimate triage collection
level: high
```

**Known false positives:**

- Backup/sync software (e.g. cloud backup agents) enumerating user profile directories
- Endpoint migration or profile-transfer tools
- Security/IR tooling performing legitimate triage collection

**Tuning notes:** Raise or lower the distinct_targets/count threshold (default 5) based on observed baseline for legitimate backup/EDR agents; allowlist known-good process hashes/signers for IT-managed migration tools; narrow the file-path list to your environment's actual browser/wallet/password-manager install paths to reduce noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Dolphin X — AI-Profiler Discovery Correlated With SSH Key / .env Secret Access (locked: unlock with TL Creds)
- Dolphin X — Chained UAC-Bypass Launcher Activity (locked: unlock with TL Creds)
- Dolphin X — Explorer.exe Spawned Under Non-Default Desktop (HVNC Indicator) (locked: unlock with TL Creds)
- Dolphin X — Bulk Cryptocurrency Wallet Extension / Password Manager Vault Access (locked: unlock with TL Creds)
- Dolphin X — In-Memory AmsiScanBuffer Patch and ETW Provider Tamper Attempt (locked: unlock with TL Creds)
- Dolphin X — SOCKS5 Proxy Tunnel Established From Unexpected Parent Process (locked: unlock with TL Creds)
- Dolphin X — Registry Run-Key Persistence Paired With One-Time Scheduled Task (locked: unlock with TL Creds)
- Dolphin X — Egress to Backend Build/Licensing Endpoint Followed by New Executable Drop (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 17)

Defanged, TLP:CLEAR.

- Domain: `thedolphinx[.]top`
- File hash: `726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Windows Stealer Uses AI Profiling to Score Victims and Prioritize High-Value Targets](https://gbhackers.com/windows-stealer-uses-ai-profiling/)
- [Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI](https://www.varonis.com/blog/dolphin-x-stealer)
- [New Dolphin X malware uses AI to rank high-value targets](https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/)
- [Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits](https://www.theregister.com/security/2026/07/22/sneaky_windows_stealer_targets_300_apps_gives_crims_an_ai_profiler_to_maximize_profits/5275962)
- [New Dolphin X Malware Uses AI Profiler to Rank High-Value Victims](https://hackread.com/dolphin-x-malware-ai-profiler-rank-victims/)
- [New Dolphin X infostealer uses AI to identify high-value victims](https://cyberinsider.com/new-dolphin-x-infostealer-uses-ai-to-identify-high-value-victims/)
- [Dolphin X Stealer Uses AI to Rank High-Value Victims](https://socprime.com/active-threats/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai/)
- [New Dolphin X Stealer Employs AI Profiling to Prioritize Targets](https://www.infosecurity-magazine.com/news/new-dolphin-x-stealer-ai-targets/)
- [New Dolphin X Malware Steals Credentials From 300+ Apps and Profiles Victims With AI](https://cybersecuritynews.com/new-dolphin-x-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1695