Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications

Key facts for Dolphin X clipper DDoS panel

Detection coverage for Dolphin X clipper DDoS panel

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1698 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection (SPL)

Detects a process creating a single archive (.zip/.tar.gz/.rar) within a short window of touching multiple credential-bearing files (browser Login Data/Cookies, SSH private keys, .env files, cloud-CLI credential stores) — the single-collection-run pattern Varonis documented for the Dolphin X infostealer across its 300+-application targeting. Also flags a direct hash match against the known operator-panel SHA-256.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1560, T1555.003, T1552.001, T1552.004
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)\.(zip|tar\.gz|rar)$")
| rename ProcessId as archive_pid, Image as archive_image, TargetFilename as archive_path
| join type=inner archive_pid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      | where match(TargetFilename, "(?i)(Login Data|Cookies|\.env$|id_rsa$|\\.aws\\credentials|credentials\.db)")
      | rename ProcessId as archive_pid
      | stats count as credential_touch_count values(TargetFilename) as credential_paths earliest(_time) as first_touch latest(_time) as last_touch by archive_pid Computer ]
| where credential_touch_count >= 3 AND (last_touch - first_touch) <= 300
| eval hash_match=if(match(archive_image, "(?i)726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0"), "known_dolphinx_binary", "unknown_binary")
| table _time Computer archive_image archive_path credential_touch_count credential_paths hash_match
| sort -_time

Microsoft KQL

let CredentialPaths = dynamic(["Login Data","Cookies",".env","id_rsa",".aws\\credentials","credentials.db"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (CredentialPaths)
| summarize CredentialTouchCount = dcount(FileName), CredentialPaths = make_set(FileName), FirstTouch = min(Timestamp), LastTouch = max(Timestamp) by InitiatingProcessId, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType == "FileCreated"
    | where FolderPath endswith ".zip" or FolderPath endswith ".tar.gz" or FolderPath endswith ".rar"
    | project ArchivePath = FolderPath, ArchiveTime = Timestamp, InitiatingProcessId, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
) on InitiatingProcessId, DeviceName
| where CredentialTouchCount >= 3 and (ArchiveTime - LastTouch) between (-5min .. 5min)
| extend KnownDolphinXHash = InitiatingProcessSHA256 == "726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0"
| project DeviceName, InitiatingProcessFileName, ArchivePath, CredentialTouchCount, CredentialPaths, KnownDolphinXHash, ArchiveTime
| sort by ArchiveTime desc

Sigma

title: Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection
id: a1e4f2c8-7b3d-4a6e-9c1f-2d8b6e4a9f01
status: experimental
description: Detects a process creating a single archive (.zip/.tar.gz/.rar) shortly after touching multiple credential-bearing files (browser Login Data/Cookies, SSH private keys, .env files, cloud-CLI credential stores) — the single-collection-run pattern documented for the Dolphin X infostealer/RAT.
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-25
tags:
    - attack.collection
    - attack.t1560
    - attack.credential-access
    - attack.t1555.003
    - attack.t1552.001
    - attack.t1552.004
    - attack.tool.dolphin_x
logsource:
    category: file_event
    product: windows
detection:
    selection_source_paths:
        TargetFilename|contains:
            - 'Login Data'
            - 'Cookies'
            - '.env'
            - 'id_rsa'
            - '\.aws\credentials'
            - 'credentials.db'
    selection_archive:
        TargetFilename|endswith:
            - '.zip'
            - '.tar.gz'
            - '.rar'
    timeframe: 5m
    condition: selection_source_paths and selection_archive | count(TargetFilename) by ProcessGuid >= 3
falsepositives:
    - Legitimate backup, sync, or dotfile-management tooling that bundles developer credential files in one operation (scope to unexpected/unsigned parent processes)
level: high

Known false positives:

• Legitimate backup/sync/dotfile-management tooling bundling credential files in one archive operation
• Developer IDE or password-manager export/backup features that touch multiple credential paths in a short window

Tuning notes: Allowlist known corporate backup/EDR agent SHA-256s and signed IT-managed sync tools; tighten the 5-minute correlation window if backup-job false positives persist; extend the credential-path list with org-specific password-manager vault file names.

• 🔒 Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection (KQL) · unlock with TL Creds
• 🔒 AMSI/ETW Tampering, UAC Bypass & Registry Persistence Preceding Credential-Store/Process-Injection Access (KQL) · unlock with TL Creds
• 🔒 Dolphin X C2 Beacon to [indicator], SOCKS5 Proxy Tunneling & HVNC Non-Default-Desktop Indicator (KQL) · unlock with TL Creds
• 🔒 Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection (Sigma) · unlock with TL Creds
• 🔒 AMSI/ETW Tampering, UAC Bypass & Registry Persistence Preceding Credential-Store/Process-Injection Access (Sigma) · unlock with TL Creds
• 🔒 Dolphin X C2 Beacon to [indicator], SOCKS5 Proxy Tunneling & HVNC Non-Default-Desktop Indicator (Sigma) · unlock with TL Creds
• 🔒 AMSI/ETW Tampering, UAC Bypass & Registry Persistence Preceding Credential-Store/Process-Injection Access (SPL) · unlock with TL Creds
• 🔒 Dolphin X C2 Beacon to [indicator], SOCKS5 Proxy Tunneling & HVNC Non-Default-Desktop Indicator (SPL) · unlock with TL Creds

Indicators of compromise for Dolphin X clipper DDoS panel

As of 2026-07-25, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-1698.

Sample indicators (2 of 19)

• Domain: thedolphinx[.]top
• File hash: 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How Dolphin X clipper DDoS panel works

Its standout feature is an "AI Profiler" that scores infected machines by application usage, browsing activity, and installed software, delivering attackers a daily ranked summary to prioritize the most valuable victims (developers, DevOps engineers, crypto holders).

Varonis Threat Labs (researcher Daniel Kelley) discovered Dolphin X after obtaining access to its operator panel, builder, and network traffic in an isolated lab. It is advertised on cybercrime forums by an alias, "Kontraktnik" (suspected Russian-speaking, panel and forum thread in English/Russian only), as an all-in-one Windows package combining an infostealer, remote access trojan, Hidden VNC (HVNC) module, cryptocurrency clipboard hijacker, SOCKS5 reverse proxy, loader, and DDoS bot. Subscription pricing runs roughly EUR69.95-$230/month across tiers, with lifetime options from $1,140 (basic) to $3,420 (pro); the sales thread has exceeded 3,000 views with at least two confirmed deals and positive buyer feedback as of late July 2026. Builds are configured via a desktop client and then compiled server-side at backend.thedolphinx[.]top:8443, a centralized choke point that also handles licensing and telemetry and lets the vendor gate a three-tier mutation engine (control-flow rewriting, instruction substitution, string re-encryption with random keys, import-table shuffling, and PE timestamp/Rich header/section-padding rewriting) behind higher-priced tiers so every compiled build is functionally unique and defeats hash/signature detection.

The credential-theft surface spans 300+ applications: 9 Chromium- and Gecko-based browsers (passwords, cookies, autofill), 100+ cryptocurrency wallet browser extensions, 65 desktop crypto wallets, 10 password managers, 30+ cloud CLI tools (AWS/Azure/GCP), plus SSH private keys, .env files, cloud access tokens, DevOps credentials, WiFi passwords, Windows Credential Manager entries, and session data for platforms such as Discord, Telegram, and Steam. A single collection run aggregates all of this into one archive, giving an operator a path from a single infected endpoint straight into an organization's cloud and CI/CD estate. Beyond credential theft, Dolphin X offers full remote-desktop control, a reverse shell, an HVNC module for covert desktop interaction (explorer.exe spawned under a non-default desktop is the primary host indicator), and a cryptocurrency clipper that silently swaps copied wallet addresses for attacker-controlled ones.

The malware's differentiator is its "AI Profiler," a surveillance tab inside the operator panel that automatically analyzes each infected machine's application usage, browsing activity, and installed software to assign a numeric risk score and set of risk factors, then emails/pushes operators a daily ranked summary. Code strings recovered from the panel binary — Auto-Start AI Profiler, ProfilerStart, ProfilerGetData, risk_score, risk_factors, categoryusage — confirm the profiling workflow is implemented, not just marketing copy. This lets an operator running thousands of simultaneous infections skip manual triage and jump straight to machines most likely to belong to developers, DevOps staff, finance workers, or cryptocurrency holders.

Defense evasion includes AMSI and ETW patching, eight distinct UAC-bypass techniques, direct syscalls, and process injection into browser and wallet processes; persistence is achieved via Registry Run keys/startup folder and scheduled tasks. The builder includes geofencing to avoid infecting hosts in Commonwealth of Independent States (CIS) countries, a common operational-security pattern among Russian-speaking cybercrime operators to avoid domestic prosecution. Varonis's analysis was limited to the operator panel, builder, and network traffic rather than executing a live sample, so advertised collection capabilities (and any in-the-wild infection volume) remain vendor-claimed and not independently confirmed at publication; however, confirmed forum sales indicate the tool is already in criminal hands. Varonis's core defensive guidance: get long-lived credentials off disk and out of project directories, and shift detection from file signatures (defeated by the mutation engine) to behavior — HVNC desktop-switch indicators, cloud-CLI/credential-store access anomalies, and process-injection telemetry.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1115 Clipboard Data; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059 Command and Scripting Interpreter; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1219 Remote Access Tools

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery; T1518 Software Discovery

Initial Access

T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment

Impact

T1499 Endpoint Denial of Service

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager; T1555.005 Password Managers

Privilege Escalation

T1548.002 Bypass User Account Control

privilege-escalation

T1548.002 Bypass User Account Control

Resource Development

T1583.001 Domains; T1587.001 Malware

defense-impairment

T1685 Disable or Modify Tools

Remediation for Dolphin X clipper DDoS panel

Immediate actions

• Rotate/revoke credentials (browser-saved passwords, SSH keys, cloud/DevOps tokens, password-manager vaults, Windows Credential Manager entries) on any host suspected of Dolphin X infection
• Hunt for explorer.exe processes running under a non-default desktop as a host-based HVNC indicator
• Block and alert on DNS/network traffic to thedolphinx[.]top and backend.thedolphinx[.]top:8443
• Search EDR/AV telemetry for the operator-panel SHA-256 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 and related process-injection or AMSI/ETW-tampering events

Workarounds

• Restrict outbound network access from developer and DevOps workstations to reduce SOCKS5-proxy/C2 exfiltration paths
• Control or disable installation of cryptocurrency wallet browser extensions on corporate endpoints
• Monitor cloud CLI (AWS/Azure/GCP) invocation from endpoints for anomalous credential use following a suspected compromise

Longer-term hardening

• Move from long-lived, on-disk secrets (.env files, static cloud tokens, SSH keys) to short-lived, vaulted credentials (cloud STS/OIDC federation, secrets managers) that Dolphin X's file-grabbing modules cannot harvest
• Deploy behavior-based EDR detections for process injection into browser/wallet processes, AMSI/ETW tampering, UAC-bypass chains, and unexpected SOCKS5 proxy traffic, since the three-tier mutation engine defeats static/hash-based signatures
• Enforce MFA and least-privilege access on cloud consoles, CI/CD systems, and DevOps tooling to reduce the value of any stolen static credential
• Prioritize security awareness for developer/DevOps/finance staff and cryptocurrency holders, the exact profile the AI Profiler is built to surface

Affected and fixed versions

• Microsoft — Windows (10, 11, Server) — malware execution platform
• Various — 9 Chromium- and Gecko-based web browsers (credential/cookie/autofill theft target)
• Various — 100+ cryptocurrency wallet browser extensions
• Various — 65 desktop cryptocurrency wallet applications
• Various — 10 password manager applications
• Various — 30+ cloud CLI tools (AWS CLI, Azure CLI, GCP CLI)

Timeline of Dolphin X clipper DDoS panel

• 2026-07-22 The Register publishes the first mainstream report on locked-ioc-15's AI Profiler, 300+ application targeting, and MaaS pricing, citing locked-ioc-8 research.
• 2026-07-22 locked-ioc-13's underground-forum sales thread for locked-ioc-15 is observed to have exceeded 3,000 views with at least two confirmed sales and positive buyer feedback.
• 2026-07-22 locked-ioc-13's tiered pricing is documented: roughly EUR69.95/$80 to $230 per month subscriptions, with lifetime tiers from $1,140 (basic) to $3,420 (pro).
• 2026-07-22 Varonis documents the locked-ioc-5's 329 features across ten categories, confirming the AI Profiler workflow via recovered code strings (locked-ioc-7, ProfilerStart, ProfilerGetData, locked-ioc-14, locked-ioc-12, categoryusage).
• 2026-07-22 locked-ioc-8 (researcher Daniel Kelley) publishes technical analysis of locked-ioc-15 after obtaining access to its operator panel, builder, and network traffic in an isolated lab environment.
• 2026-07-23 TL-Intel Harness ingests locked-ioc-15 reporting via the Infosecurity Magazine RSS feed into the HUNT phase as threat TL-2026-1698.
• 2026-07-23 Infosecurity Magazine, BleepingComputer, GBHackers, CyberSecurityNews, CyberInsider, SOCPrime, TechNadu, and PCrisk publish independent coverage of locked-ioc-15's AI Profiler and credential-theft capabilities.
• 2026-07-25 Additional outlets (PRSOL:CC, We Fix PC) republish locked-ioc-15 reporting, indicating sustained industry attention on the threat one week after initial disclosure.

Sources cited for Dolphin X clipper DDoS panel

• Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI varonis.com · Vendor report · 2026-07-22
• Dolphin X Stealer Uses AI to Rank High-Value Victims socprime.com · Blog · 2026-07-23
• Dolphin X RAT - Malware removal instructions pcrisk.com · Blog · 2026-07-23
• New Dolphin X Stealer Employs AI Profiling to Prioritize Targets infosecurity-magazine.com · News · 2026-07-23
• Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits The Register · News · 2026-07-22
• New Dolphin X malware uses AI to rank high-value targets BleepingComputer · News · 2026-07-23
• New Windows Stealer Uses AI Profiling to Identify High-Value Corporate Victims gbhackers.com · News · 2026-07-23
• New Dolphin X Malware Steals Credentials From 300+ Apps and Profiles Victims With AI cybersecuritynews.com · News · 2026-07-23
• New Dolphin X infostealer uses AI to identify high-value victims cyberinsider.com · News · 2026-07-23
• Dolphin X Stealer Targets 300+ Apps With AI Victim Profiling technadu.com · News · 2026-07-23

Threats related to Dolphin X clipper DDoS panel

• Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx[.]top)
• Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims
• Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel
• Pass-ta-Key Attacks Let Malware Hijack Google Password Manager Synchronized Passkeys (Chrome on Windows)
• Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting Finance Teams

Related coverage of this activity

• Remus 64-bit Lumma-splinter infostealer
• Vidar 2.0 infostealer

Previous and next in malware

• SourTrade Malvertising: ServiceWorker-Orchestrated In-Browser Assembly Builds a Unique Windows Executable Per Victim Previous report
• Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig, VShell, SoftEther VPN via Multi-Tool Toolkit Next report