# Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications

> Dolphin X is a Windows infostealer, RAT, cryptocurrency clipper, and DDoS bot sold as malware-as-a-service by the underground-forum vendor "Kontraktnik," targeting 300+ applications (browsers, crypto wallets, password managers, cloud CLI tools, SSH keys, .env files) across an operator panel with 329 features in 10 categories. Its standout feature is an "AI Profiler" that scores infected machines by application usage, browsing activity, and installed software, delivering attackers a daily ranked summary to prioritize the most valuable victims (developers, DevOps engineers, crypto holders).

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1698
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-dolphin-x-clipper-ddos-panel-tl-2026-1698.webp?v=6561e08d (Threadlinqs threat intel: Dolphin X Stealer, Clipper and DDoS Bot: Detection & IOCs (TL-2026-1698) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-1698
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kontraktnik
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (2 shown free below)

## Description

Varonis Threat Labs (researcher Daniel Kelley) discovered Dolphin X after obtaining access to its operator panel, builder, and network traffic in an isolated lab. It is advertised on cybercrime forums by an alias, "Kontraktnik" (suspected Russian-speaking, panel and forum thread in English/Russian only), as an all-in-one Windows package combining an infostealer, remote access trojan, Hidden VNC (HVNC) module, cryptocurrency clipboard hijacker, SOCKS5 reverse proxy, loader, and DDoS bot. Subscription pricing runs roughly EUR69.95-$230/month across tiers, with lifetime options from $1,140 (basic) to $3,420 (pro); the sales thread has exceeded 3,000 views with at least two confirmed deals and positive buyer feedback as of late July 2026. Builds are configured via a desktop client and then compiled server-side at backend.thedolphinx[.]top:8443, a centralized choke point that also handles licensing and telemetry and lets the vendor gate a three-tier mutation engine (control-flow rewriting, instruction substitution, string re-encryption with random keys, import-table shuffling, and PE timestamp/Rich header/section-padding rewriting) behind higher-priced tiers so every compiled build is functionally unique and defeats hash/signature detection.

The credential-theft surface spans 300+ applications: 9 Chromium- and Gecko-based browsers (passwords, cookies, autofill), 100+ cryptocurrency wallet browser extensions, 65 desktop crypto wallets, 10 password managers, 30+ cloud CLI tools (AWS/Azure/GCP), plus SSH private keys, .env files, cloud access tokens, DevOps credentials, WiFi passwords, Windows Credential Manager entries, and session data for platforms such as Discord, Telegram, and Steam. A single collection run aggregates all of this into one archive, giving an operator a path from a single infected endpoint straight into an organization's cloud and CI/CD estate. Beyond credential theft, Dolphin X offers full remote-desktop control, a reverse shell, an HVNC module for covert desktop interaction (explorer.exe spawned under a non-default desktop is the primary host indicator), and a cryptocurrency clipper that silently swaps copied wallet addresses for attacker-controlled ones.

The malware's differentiator is its "AI Profiler," a surveillance tab inside the operator panel that automatically analyzes each infected machine's application usage, browsing activity, and installed software to assign a numeric risk score and set of risk factors, then emails/pushes operators a daily ranked summary. Code strings recovered from the panel binary — Auto-Start AI Profiler, ProfilerStart, ProfilerGetData, risk_score, risk_factors, categoryusage — confirm the profiling workflow is implemented, not just marketing copy. This lets an operator running thousands of simultaneous infections skip manual triage and jump straight to machines most likely to belong to developers, DevOps staff, finance workers, or cryptocurrency holders.

Defense evasion includes AMSI and ETW patching, eight distinct UAC-bypass techniques, direct syscalls, and process injection into browser and wallet processes; persistence is achieved via Registry Run keys/startup folder and scheduled tasks. The builder includes geofencing to avoid infecting hosts in Commonwealth of Independent States (CIS) countries, a common operational-security pattern among Russian-speaking cybercrime operators to avoid domestic prosecution. Varonis's analysis was limited to the operator panel, builder, and network traffic rather than executing a live sample, so advertised collection capabilities (and any in-the-wild infection volume) remain vendor-claimed and not independently confirmed at publication; however, confirmed forum sales indicate the tool is already in criminal hands. Varonis's core defensive guidance: get long-lived credentials off disk and out of project directories, and shift detection from file signatures (defeated by the mutation engine) to behavior — HVNC desktop-switch indicators, cloud-CLI/credential-store access anomalies, and process-injection telemetry.

## MITRE ATT&CK

- T1587.001 Malware
- T1583.001 Domains
- T1566.001 Spearphishing Attachment
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1548.002 Bypass User Account Control
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1555.005 Password Managers
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1518 Software Discovery
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1090 Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1499 Endpoint Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection (SPL)** (`TL-2026-1698-SPL-001`)

Detects a process creating a single archive (.zip/.tar.gz/.rar) within a short window of touching multiple credential-bearing files (browser Login Data/Cookies, SSH private keys, .env files, cloud-CLI credential stores) — the single-collection-run pattern Varonis documented for the Dolphin X infostealer across its 300+-application targeting. Also flags a direct hash match against the known operator-panel SHA-256.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1560, T1555.003, T1552.001, T1552.004
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)\.(zip|tar\.gz|rar)$")
| rename ProcessId as archive_pid, Image as archive_image, TargetFilename as archive_path
| join type=inner archive_pid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      | where match(TargetFilename, "(?i)(Login Data|Cookies|\.env$|id_rsa$|\\.aws\\credentials|credentials\.db)")
      | rename ProcessId as archive_pid
      | stats count as credential_touch_count values(TargetFilename) as credential_paths earliest(_time) as first_touch latest(_time) as last_touch by archive_pid Computer ]
| where credential_touch_count >= 3 AND (last_touch - first_touch) <= 300
| eval hash_match=if(match(archive_image, "(?i)726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0"), "known_dolphinx_binary", "unknown_binary")
| table _time Computer archive_image archive_path credential_touch_count credential_paths hash_match
| sort -_time
```

### Microsoft KQL

```kql
let CredentialPaths = dynamic(["Login Data","Cookies",".env","id_rsa",".aws\\credentials","credentials.db"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (CredentialPaths)
| summarize CredentialTouchCount = dcount(FileName), CredentialPaths = make_set(FileName), FirstTouch = min(Timestamp), LastTouch = max(Timestamp) by InitiatingProcessId, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType == "FileCreated"
    | where FolderPath endswith ".zip" or FolderPath endswith ".tar.gz" or FolderPath endswith ".rar"
    | project ArchivePath = FolderPath, ArchiveTime = Timestamp, InitiatingProcessId, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
) on InitiatingProcessId, DeviceName
| where CredentialTouchCount >= 3 and (ArchiveTime - LastTouch) between (-5min .. 5min)
| extend KnownDolphinXHash = InitiatingProcessSHA256 == "726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0"
| project DeviceName, InitiatingProcessFileName, ArchivePath, CredentialTouchCount, CredentialPaths, KnownDolphinXHash, ArchiveTime
| sort by ArchiveTime desc
```

### Sigma

```yaml
title: Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection
id: a1e4f2c8-7b3d-4a6e-9c1f-2d8b6e4a9f01
status: experimental
description: Detects a process creating a single archive (.zip/.tar.gz/.rar) shortly after touching multiple credential-bearing files (browser Login Data/Cookies, SSH private keys, .env files, cloud-CLI credential stores) — the single-collection-run pattern documented for the Dolphin X infostealer/RAT.
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-25
tags:
    - attack.collection
    - attack.t1560
    - attack.credential-access
    - attack.t1555.003
    - attack.t1552.001
    - attack.t1552.004
    - attack.tool.dolphin_x
logsource:
    category: file_event
    product: windows
detection:
    selection_source_paths:
        TargetFilename|contains:
            - 'Login Data'
            - 'Cookies'
            - '.env'
            - 'id_rsa'
            - '\.aws\credentials'
            - 'credentials.db'
    selection_archive:
        TargetFilename|endswith:
            - '.zip'
            - '.tar.gz'
            - '.rar'
    timeframe: 5m
    condition: selection_source_paths and selection_archive | count(TargetFilename) by ProcessGuid >= 3
falsepositives:
    - Legitimate backup, sync, or dotfile-management tooling that bundles developer credential files in one operation (scope to unexpected/unsigned parent processes)
level: high
```

**Known false positives:**

- Legitimate backup/sync/dotfile-management tooling bundling credential files in one archive operation
- Developer IDE or password-manager export/backup features that touch multiple credential paths in a short window

**Tuning notes:** Allowlist known corporate backup/EDR agent SHA-256s and signed IT-managed sync tools; tighten the 5-minute correlation window if backup-job false positives persist; extend the credential-path list with org-specific password-manager vault file names.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection (KQL) (locked: unlock with TL Creds)
- AMSI/ETW Tampering, UAC Bypass & Registry Persistence Preceding Credential-Store/Process-Injection Access (KQL) (locked: unlock with TL Creds)
- Dolphin X C2 Beacon to [indicator], SOCKS5 Proxy Tunneling & HVNC Non-Default-Desktop Indicator (KQL) (locked: unlock with TL Creds)
- Dolphin X Single-Archive Browser/SSH/.env/Cloud-CLI Credential Collection (Sigma) (locked: unlock with TL Creds)
- AMSI/ETW Tampering, UAC Bypass & Registry Persistence Preceding Credential-Store/Process-Injection Access (Sigma) (locked: unlock with TL Creds)
- Dolphin X C2 Beacon to [indicator], SOCKS5 Proxy Tunneling & HVNC Non-Default-Desktop Indicator (Sigma) (locked: unlock with TL Creds)
- AMSI/ETW Tampering, UAC Bypass & Registry Persistence Preceding Credential-Store/Process-Injection Access (SPL) (locked: unlock with TL Creds)
- Dolphin X C2 Beacon to [indicator], SOCKS5 Proxy Tunneling & HVNC Non-Default-Desktop Indicator (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 19)

Defanged, TLP:CLEAR.

- Domain: `thedolphinx[.]top`
- File hash: `726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New Dolphin X Stealer Employs AI Profiling to Prioritize Targets](https://www.infosecurity-magazine.com/news/new-dolphin-x-stealer-ai-targets/)
- [Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI](https://www.varonis.com/blog/dolphin-x-stealer)
- [Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits](https://www.theregister.com/security/2026/07/22/sneaky-windows-stealer-targets-300-apps-gives-crims-an-ai-profiler-to-maximize-profits/5275962)
- [New Dolphin X malware uses AI to rank high-value targets](https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/)
- [New Windows Stealer Uses AI Profiling to Identify High-Value Corporate Victims](https://gbhackers.com/windows-stealer-uses-ai-profiling/)
- [New Dolphin X Malware Steals Credentials From 300+ Apps and Profiles Victims With AI](https://cybersecuritynews.com/new-dolphin-x-malware/)
- [New Dolphin X infostealer uses AI to identify high-value victims](https://cyberinsider.com/new-dolphin-x-infostealer-uses-ai-to-identify-high-value-victims/)
- [Dolphin X Stealer Uses AI to Rank High-Value Victims](https://socprime.com/active-threats/dolphin-x-stealer-targets-300-apps-and-profiles-users-with-ai/)
- [Dolphin X RAT - Malware removal instructions](https://www.pcrisk.com/removal-guides/35640-dolphin-x-rat)
- [Dolphin X Stealer Targets 300+ Apps With AI Victim Profiling](https://www.technadu.com/dolphin-x-new-windows-stealer-uses-ai-to-rank-which-victims-are-worth-robbing/631754/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1698