Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications
Dolphin X Stealer (TL-2026-1698), also tracked as Dolphin X Stealer, is a high-severity malware campaign, first published 2026-07-25. It is attributed to Kontraktnik with low confidence, affects Microsoft Windows (10, 11, Server) — malware execution platform, maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1698
- Threat ID
- TL-2026-1698
- Also known as
- Dolphin X Stealer, Dolphin X RAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-25
- Last reviewed
- 2026-07-25
- Attribution
- Kontraktnik
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, cryptocurrency, softwaredevelopment, cloudservices
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Dolphin X Stealer
Malware and tooling: Dolphin X, Dolphin X RAT, Dolphin X Stealer, Dolphin X Operator Panel
Dolphin X is a Windows infostealer, RAT, cryptocurrency clipper, and DDoS bot sold as malware-as-a-service by the underground-forum vendor "Kontraktnik," targeting 300+ applications (browsers, crypto wallets, password managers, cloud CLI tools, SSH keys, .env files) across an operator panel with 329 features in 10 categories. Its standout feature is an "AI Profiler" that scores infected machines by application usage, browsing activity, and installed software, delivering attackers a daily ranked summary to prioritize the most valuable victims (developers, DevOps engineers, crypto holders).
How Dolphin X Stealer works
Varonis Threat Labs (researcher Daniel Kelley) discovered Dolphin X after obtaining access to its operator panel, builder, and network traffic in an isolated lab. It is advertised on cybercrime forums by an alias, "Kontraktnik" (suspected Russian-speaking, panel and forum thread in English/Russian only), as an all-in-one Windows package combining an infostealer, remote access trojan, Hidden VNC (HVNC) module, cryptocurrency clipboard hijacker, SOCKS5 reverse proxy, loader, and DDoS bot. Subscription pricing runs roughly EUR69.95-$230/month across tiers, with lifetime options from $1,140 (basic) to $3,420 (pro); the sales thread has exceeded 3,000 views with at least two confirmed deals and positive buyer feedback as of late July 2026. Builds are configured via a desktop client and then compiled server-side at backend.thedolphinx[.]top:8443, a centralized choke point that also handles licensing and telemetry and lets the vendor gate a three-tier mutation engine (control-flow rewriting, instruction substitution, string re-encryption with random keys, import-table shuffling, and PE timestamp/Rich header/section-padding rewriting) behind higher-priced tiers so every compiled build is functionally unique and defeats hash/signature detection.
The credential-theft surface spans 300+ applications: 9 Chromium- and Gecko-based browsers (passwords, cookies, autofill), 100+ cryptocurrency wallet browser extensions, 65 desktop crypto wallets, 10 password managers, 30+ cloud CLI tools (AWS/Azure/GCP), plus SSH private keys, .env files, cloud access tokens, DevOps credentials, WiFi passwords, Windows Credential Manager entries, and session data for platforms such as Discord, Telegram, and Steam. A single collection run aggregates all of this into one archive, giving an operator a path from a single infected endpoint straight into an organization's cloud and CI/CD estate. Beyond credential theft, Dolphin X offers full remote-desktop control, a reverse shell, an HVNC module for covert desktop interaction (explorer.exe spawned under a non-default desktop is the primary host indicator), and a cryptocurrency clipper that silently swaps copied wallet addresses for attacker-controlled ones.
The malware's differentiator is its "AI Profiler," a surveillance tab inside the operator panel that automatically analyzes each infected machine's application usage, browsing activity, and installed software to assign a numeric risk score and set of risk factors, then emails/pushes operators a daily ranked summary. Code strings recovered from the panel binary — Auto-Start AI Profiler, ProfilerStart, ProfilerGetData, risk_score, risk_factors, categoryusage — confirm the profiling workflow is implemented, not just marketing copy. This lets an operator running thousands of simultaneous infections skip manual triage and jump straight to machines most likely to belong to developers, DevOps staff, finance workers, or cryptocurrency holders.
Defense evasion includes AMSI and ETW patching, eight distinct UAC-bypass techniques, direct syscalls, and process injection into browser and wallet processes; persistence is achieved via Registry Run keys/startup folder and scheduled tasks. The builder includes geofencing to avoid infecting hosts in Commonwealth of Independent States (CIS) countries, a common operational-security pattern among Russian-speaking cybercrime operators to avoid domestic prosecution. Varonis's analysis was limited to the operator panel, builder, and network traffic rather than executing a live sample, so advertised collection capabilities (and any in-the-wild infection volume) remain vendor-claimed and not independently confirmed at publication; however, confirmed forum sales indicate the tool is already in criminal hands. Varonis's core defensive guidance: get long-lived credentials off disk and out of project directories, and shift detection from file signatures (defeated by the mutation engine) to behavior — HVNC desktop-switch indicators, cloud-CLI/credential-store access anomalies, and process-injection telemetry.
MITRE ATT&CK techniques used in TL-2026-1698
Collection
T1005 Data from Local System; T1115 Clipboard Data; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059 Command and Scripting Interpreter; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1219 Remote Access Tools
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery; T1518 Software Discovery
Initial Access
T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment
Impact
T1499 Endpoint Denial of Service
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager; T1555.005 Password Managers
Privilege Escalation
T1548.002 Bypass User Account Control
privilege-escalation
T1548.002 Bypass User Account Control
Resource Development
T1583.001 Domains; T1587.001 Malware
defense-impairment
Affected products and versions in Dolphin X Stealer
- Microsoft — Windows (10, 11, Server) — malware execution platform
- Various — 9 Chromium- and Gecko-based web browsers (credential/cookie/autofill theft target)
- Various — 100+ cryptocurrency wallet browser extensions
- Various — 65 desktop cryptocurrency wallet applications
- Various — 10 password manager applications
- Various — 30+ cloud CLI tools (AWS CLI, Azure CLI, GCP CLI)
Remediation for Dolphin X Stealer
Immediate actions
- Rotate/revoke credentials (browser-saved passwords, SSH keys, cloud/DevOps tokens, password-manager vaults, Windows Credential Manager entries) on any host suspected of Dolphin X infection
- Hunt for explorer.exe processes running under a non-default desktop as a host-based HVNC indicator
- Block and alert on DNS/network traffic to thedolphinx[.]top and backend.thedolphinx[.]top:8443
- Search EDR/AV telemetry for the operator-panel SHA-256 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 and related process-injection or AMSI/ETW-tampering events
Workarounds
- Restrict outbound network access from developer and DevOps workstations to reduce SOCKS5-proxy/C2 exfiltration paths
- Control or disable installation of cryptocurrency wallet browser extensions on corporate endpoints
- Monitor cloud CLI (AWS/Azure/GCP) invocation from endpoints for anomalous credential use following a suspected compromise
Longer-term hardening
- Move from long-lived, on-disk secrets (.env files, static cloud tokens, SSH keys) to short-lived, vaulted credentials (cloud STS/OIDC federation, secrets managers) that Dolphin X's file-grabbing modules cannot harvest
- Deploy behavior-based EDR detections for process injection into browser/wallet processes, AMSI/ETW tampering, UAC-bypass chains, and unexpected SOCKS5 proxy traffic, since the three-tier mutation engine defeats static/hash-based signatures
- Enforce MFA and least-privilege access on cloud consoles, CI/CD systems, and DevOps tooling to reduce the value of any stolen static credential
- Prioritize security awareness for developer/DevOps/finance staff and cryptocurrency holders, the exact profile the AI Profiler is built to surface
Timeline of Dolphin X Stealer
- The Register publishes the first mainstream report on Dolphin X's AI Profiler, 300+ application targeting, and MaaS pricing, citing Varonis Threat Labs research.
- Kontraktnik's underground-forum sales thread for Dolphin X is observed to have exceeded 3,000 views with at least two confirmed sales and positive buyer feedback.
- Kontraktnik's tiered pricing is documented: roughly EUR69.95/$80 to $230 per month subscriptions, with lifetime tiers from $1,140 (basic) to $3,420 (pro).
- Varonis documents the Dolphin X operator panel's 329 features across ten categories, confirming the AI Profiler workflow via recovered code strings (Auto-Start AI Profiler, ProfilerStart, ProfilerGetData, risk_score, risk_factors, categoryusage).
- Varonis Threat Labs (researcher Daniel Kelley) publishes technical analysis of Dolphin X after obtaining access to its operator panel, builder, and network traffic in an isolated lab environment.
- TL-Intel Harness ingests Dolphin X reporting via the Infosecurity Magazine RSS feed into the HUNT phase as threat TL-2026-1698.
- Infosecurity Magazine, BleepingComputer, GBHackers, CyberSecurityNews, CyberInsider, SOCPrime, TechNadu, and PCrisk publish independent coverage of Dolphin X's AI Profiler and credential-theft capabilities.
- Additional outlets (PRSOL:CC, We Fix PC) republish Dolphin X reporting, indicating sustained industry attention on the threat one week after initial disclosure.
Sources cited for Dolphin X Stealer
- New Dolphin X Stealer Employs AI Profiling to Prioritize Targets
- Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI
- Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits
- New Dolphin X malware uses AI to rank high-value targets
- New Windows Stealer Uses AI Profiling to Identify High-Value Corporate Victims
- New Dolphin X Malware Steals Credentials From 300+ Apps and Profiles Victims With AI
- New Dolphin X infostealer uses AI to identify high-value victims
- Dolphin X Stealer Uses AI to Rank High-Value Victims
- Dolphin X RAT - Malware removal instructions
- Dolphin X Stealer Targets 300+ Apps With AI Victim Profiling
Threats related to Dolphin X Stealer
- Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx[.]top)
- Dolphin X: AI-Powered Windows Infostealer/RAT Uses Behavioral Profiling to Prioritize High-Value Victims
- Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel
- Pass-ta-Key Attacks Let Malware Hijack Google Password Manager Synchronized Passkeys (Chrome on Windows)
- Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting Finance Teams
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
Detection coverage for TL-2026-1698
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1698 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.