Loading malware…
Dolphin X is a Windows malware family marketed as both an information stealer and a remote access trojan. It is sold as a malware-as-a-service offering and has been advertised by an operator using the alias Kontraktnik. The malware is positioned as an all-in-one criminal platform that combines large-scale credential and secret theft with remote control and follow-on intrusion features.
Dolphin X is designed to collect data from more than 300 application targets. Reported collection scope includes browser-saved credentials and cookies, cryptocurrency wallet data, password manager contents, cloud command-line tool artifacts, cloud access tokens, SSH keys, developer environment files, and other DevOps or enterprise secrets. The breadth of this collection makes developer workstations, cloud administrators, cryptocurrency users, and enterprise users particularly attractive targets because a single infection may expose access to cloud environments, production systems, financial assets, or corporate networks.
A distinguishing feature of Dolphin X is its so-called AI Profiler, which is intended to analyze telemetry from infected systems and rank victims by likely value. Reported inputs include application usage, browsing activity, visited domains, installed software, and related risk factors. Operators receive ranked summaries that help them triage large numbers of compromised hosts and prioritize victims likely to yield valuable credentials, privileged enterprise access, cloud infrastructure access, or cryptocurrency holdings. The exact AI mechanism behind this profiling has not been independently verified, but profiler-related functionality appears integrated into the operator panel.
Advertised post-compromise functionality extends beyond theft. Dolphin X has been associated with hidden remote desktop or HVNC capability, malware loading, process injection, proxying, persistence options, remote command execution, and defense-evasion features. Reported evasion and build options include mutation features intended to hinder static detection and signature-based blocking, as well as configurable persistence and anti-analysis settings. The malware is built through a remote server-side process controlled through an operator panel rather than compiled locally by the customer.
Dolphin X currently targets Windows systems. Its combination of infostealing, remote access, victim prioritization, and broader post-exploitation features makes it notable as a criminal platform aimed at maximizing the operational value of each compromised host.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Varonis Threat Labs has documented a new Windows infostealer and remote access trojan (RAT) called Dolphin X. The seller promotes it as an all-in-one service that combines DDoS botnet, credential theft, remote computer control, and surveillance functions through a single operator panel.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The advertised feature set also includes process injection, scheduled-task persistence, antivirus evasion, remote command execution, and hidden remote desktop sessions.
The advertised feature set also includes process injection, scheduled-task persistence, antivirus evasion, remote command execution, and hidden remote desktop sessions.
The advertised feature set also includes process injection, scheduled-task persistence, antivirus evasion, remote command execution, and hidden remote desktop sessions.
Operators pick a C2 address, an install path, persistence, and evasion settings...
Additionally, there are paid mutation options that can alter each generated file by changing instructions, encrypted strings, import information, and file metadata. These changes are intended to make new builds harder to block using file hashes or detection rules based on fixed byte patterns.
the malware is designed to target more than 300 applications and steal a wide range of sensitive data, including cryptocurrency wallets, .env files, SSH keys, cloud tokens and DevOps credentials
Также заявлено, что вредонос якобы похищает файлы .env, SSH-ключи, облачные токены, сохраненные в браузерах учетные данные, информацию криптокошельков и секреты разработчиков.
Dolphin X is a stealer and RAT that targets 300+ applications, stealing browser credentials, cryptocurrency wallets, cloud tokens, SSH keys, and developer secrets.
These targets range from browser logins and cryptocurrency wallets to SSH keys and cloud tokens, with the collected data staged in a single archive
The panel sends selected settings, including a command-and-control address, installation path, persistence choices, and evasion options, to a remote backend that returns the compiled payload.
The operator panel also advertises process injection, registry and scheduled-task persistence, UAC bypass methods, AMSI and ETW patching, and SOCKS5 proxy support.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Dolphin X is described as a remote access trojan and full-featured stealer marketed on a hacker forum. It reportedly includes an 'AI Profiler' module that analyzes data collected from infected machines, scores victims by risk/value, prepares daily summaries, and helps operators prioritize targets. The malware is also claimed to steal data from 300+ applications, including browsers, crypto-wallet extensions, desktop wallets, password managers, cloud CLI tools, .env files, SSH keys, cloud tokens, saved browser credentials, cryptocurrency wallet data, and developer secrets.
Malware mentioned only in another headline on the page, not part of the main incident described.
A stealer and remote access trojan that targets more than 300 applications to steal browser credentials, cryptocurrency wallets, cloud tokens, SSH keys, and developer secrets. It also includes an AI-based profiling capability to prioritize high-value victims, and supports HVNC, malware loading, and DDoS functions.
Windows malware sold as an all-in-one criminal service that steals credentials and other sensitive data, profiles victims with an 'AI Profiler' to rank their value, and provides remote access and control features. Reported capabilities include targeting hundreds of applications, stealing browser passwords, cryptocurrency wallet data, SSH keys, cloud tokens, and .env files, plus process injection, scheduled-task persistence, antivirus evasion, remote command execution, and hidden remote desktop sessions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.