Dolphin X stealer adds AI victim scoring to malware-as-a-service sales pitch

Varonis Threat Labs has identified a Windows information-stealer and remote access trojan called Dolphin X that is being sold on a cybercrime forum with a claimed ability to target more than 300 applications. The notable addition is an “AI Profiler” that the seller says ranks infected victims by likely criminal payoff, a feature that would help operators decide where to spend time after an initial compromise.

The malware is advertised by a vendor using the alias Kontraktnik. According to Varonis, the sales pitch says Dolphin X can be used as a stealer, a hidden virtual network computing tool, a DDoS botnet and a loader. The developer claims it can collect browser passwords, enterprise credentials, cryptocurrency wallets, .env files, SSH keys, cloud tokens and DevOps secrets.

Daniel Kelley, a senior threat researcher at Varonis, said the AI victim-ranking capability and the breadth of targeted data stood out during the firm’s review. The profiler is described as using application activity, browsing history and installed software to generate a daily list of victims ranked by expected value.

Varonis did not validate every claim. Kelley’s team reviewed the malware builder, the operator panel and network traffic, but did not examine an active malware sample. The firm said the builder appeared to support the advertised features, while stopping short of confirming that Dolphin X performs exactly as sold.

A subscription model for commodity intrusion

Dolphin X is being packaged like a commercial software product. Varonis said the operator panel lists 329 features across 10 categories, with three monthly tiers and lifetime purchase options. The lowest monthly plan costs about $80 and includes capabilities to alter Windows Portable Executable metadata, including timestamps, Rich headers and section padding, as well as features aimed at evading brittle YARA rules and hash-based blocklists.

The middle tier advertises import table shuffling, which can change a build’s import hash. The top tier, priced at about $230 per month, claims to rewrite control flow, substitute instructions and re-encrypt embedded strings with a new random key for each build. Lifetime access is listed at about $1,140 for the basic tier, $2,280 for the middle tier and $3,420 for the top tier.

That pricing is low enough to matter. Varonis argues the packaging reduces the skill required to operate a broad infostealer campaign, pushing more functionality into a prebuilt panel rather than custom malware development. The seller’s thread had more than 3,000 views as of Tuesday, according to Varonis, and at least two confirmed purchases with positive buyer feedback.

Kontraktnik says Dolphin X currently runs only on Windows, supports English and Russian, and is being developed for Debian. Kelley said the developer appears to be Russian-speaking. Varonis also found an option to avoid infecting users in Commonwealth of Independent States countries, a pattern the firm associates with some Russian-based cybercrime groups.

Detection shifts away from signatures

For defenders, Varonis points to two practical conclusions. Long-lived credentials stored on disk should be treated as exposed once an infostealer lands, because these tools are built to collect as much local material as possible in a single run. Detection also needs to emphasize behavior over static file indicators, since Dolphin X advertises multiple ways to change binaries between builds.

Varonis cited explorer.exe running under a non-default desktop as one example of behavior that may indicate an HVNC session regardless of packing or hash changes. The firm has previously reported other AI-branded criminal tools, including the phishing kit Bluekit and the email attack tool SpamGPT, and says Dolphin X is part of a broader push by cybercriminals to use AI features to automate targeting and operations.

This story draws on original reporting from The Register.