New Dolphin X infostealer uses AI to identify high-value victims

A newly identified Windows malware called Dolphin X combines information-stealing capabilities with remote access features while targeting credentials from more than 300 applications.

The malware also includes an AI-powered profiler that automatically ranks infected users, helping attackers identify the most valuable victims.

Varonis Threat Labs analyzed Dolphin X after obtaining access to its operator panel in an isolated lab. Researchers found it being advertised on a cybercrime forum by a seller using the alias “Kontraktnik” as an all-in-one stealer and remote access trojan (RAT).

Unlike typical infostealers that focus on browser passwords, Dolphin X collects credentials and sensitive data from a broad range of sources. Varonis says it targets nine browsers, more than 100 cryptocurrency wallet extensions, 65 desktop crypto wallets, 10 password managers, 30 cloud command-line tools, as well as .env files, SSH keys, and cloud authentication tokens.

Rather than compiling malware locally, operators configure settings such as the command-and-control server, persistence, and installation path through a desktop client. The configuration is then uploaded to backend.thedolphinx[.]top:8443, where the malware is compiled and returned.

This cloud-based build process allows the malware's developers to modify every generated sample before delivery. The operator panel includes an optional mutation engine that can rewrite control flow, shuffle import tables, re-encrypt embedded strings, and alter Portable Executable (PE) metadata such as timestamps and section padding. These changes are designed to make each build more resistant to hash- and signature-based detection.

Dolphin X's AI Profiler analyzes installed software, browsing activity, and application usage to assign each victim a risk score. The malware then generates daily summaries that rank infected systems, allowing operators managing thousands of compromised devices to quickly identify developer workstations, cryptocurrency users, or other potentially lucrative targets instead of manually reviewing every infection.

Varonis notes that Dolphin X joins a growing number of cybercrime tools integrating artificial intelligence, following malware and criminal services such as SpamGPT and Bluekit, reflecting a broader trend toward AI-assisted attack automation.

To reduce the risk posed by infostealers like Dolphin X, Varonis recommends avoiding the long-term storage of credentials on local systems, especially in project directories or credential stores. The researchers also advise prioritizing behavior-based detection over file signatures, as the malware's server-side mutation capabilities can generate unique binaries that evade traditional signature- and hash-based defenses.