www.it-connect.fr
Dolphin X Infostealer Uses AI to Rank Its Victims
More than 300 targeted applications, from browsers to SSH keys and cryptocurrency wallets, plus an AI module designed to point attackers toward the most profitable victims. That is what lies behind Dolphin X, a data-stealing malware for Windows that is being sold on a cybercrime forum. Here is what we know.
Table of Contents
A data-collection scope spanning 300 applications
A report published on July 22, 2026 by Daniel Kelley, senior security researcher at Varonis, details how the Dolphin X malware works. Suffice it to say, this is a highly versatile piece of malware with broad capabilities. In fact, on the forum where it is offered for sale, Dolphin X is presented as a Swiss Army knife. It could be used as a stealer, as a RAT (to remotely control a computer), as a DDoS botnet, or simply as a loader.
In practice, Dolphin X is reportedly capable of targeting 300 different applications to steal data. According to Varonis, a single exfiltrated archive can contain data from:
- Nine browsers, Chromium and Gecko-based, with decryption via
DPAPI. - More than 100 cryptocurrency wallet extensions.
- 65 locally installed crypto wallets.
- 10 password managers.
- 30 command-line tools dedicated to Cloud.
.envfiles, SSH keys, and Cloud authentication tokens.
The operator panel, meanwhile, displays 329 features spread across ten categories. For cybercriminals, developer workstations remain a favored target, especially because they may contain SSH keys and .env files with sensitive information. Compromising a single PC can open access to other environments thanks to the stolen data. This is far from theoretical: last June, more than 400 Arch Linux AUR packages were trojanized by malware specifically designed to target developer workstations and build environments.
AI Profiler, or how to industrialize victim triage
AI Profiler is the feature that sets Dolphin X apart from the competition. It is designed to analyze installed software, browsing activity, and application usage to assign a risk score to each infected machine. Cybercriminals then receive a daily summary ranking the victims.
Why does this matter? It saves attackers time by making it easier to identify the most lucrative targets. Indeed, if a criminal controls several hundred or several thousand machines, they cannot inspect them all manually. That is why Varonis compares the AI Profiler function to an automated warehouse sorting system: it scores, labels, and then returns an ordered list of machines to inspect first. Developer workstation, cryptocurrency user, Cloud console access—the triage happens automatically.
Above all, Varonis believes this is an exclusive capability for an infostealer-type malware. Once again, this clearly shows that AI is a valuable aid for cybercriminals. Sometimes AI itself is a target for attackers, but it is increasingly becoming a component of their toolkit.
Server-side compilation
Dolphin X's architecture is designed to make detection more difficult. The operator running the attack campaign does not compile anything on their own machine: the desktop client is only used as a configuration assistant (C2 server address, installation path, persistence, evasion options). The configuration is then sent to a backend, where compilation takes place before the binary is returned.
This has two benefits for the attacker. First, the mandatory detour through their server allows them to modify each binary before delivery. Second, this on-demand compilation feeds an optional three-level mutation engine (the two deepest levels reserved for the PRO offering). This makes it possible to alter the malware code, including encrypting strings differently or shuffling the import table to change the imphash. By varying these elements from one build to the next, each sample has a different signature, rendering file-hash-based detection ineffective.
You can find Varonis's full report on this page. It includes additional information, notably the indicators of compromise for the operator side:
backend.thedolphinx[.]top:8443(host and port), used for licensing, telemetry, and the remote build service.thedolphinx[.]top(the vendor backend's parent domain).726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0(SHA-256 hash of the operator panel client executable).
Finally, it is important to note that the researchers analyzed the control panel used by the operators and its network traffic, not a malware sample running on an infected machine. The capabilities described in their report are therefore those exposed by the builder or claimed by the seller.
