Dolphin X: The Malware That Uses AI to Pick Its Best Victims

Most infostealers just dump stolen data and let criminals sort through the mess manually. Dolphin X doesn't.

This newly discovered Windows malware — sold on underground forums by a vendor going by "Kontraktnik" — pairs large-scale credential theft with something rarely seen in commodity malware: an AI Profiler that automatically ranks infected machines by value.

Instead of digging through thousands of stolen archives by hand, attackers get a daily digest telling them exactly which infections belong to developers, finance staff, system administrators, or crypto holders — so they know who to target first.

The scope is what makes it dangerous. Dolphin X claims support for 300+ applications in a single collection run: nine browsers, 100+ crypto wallet extensions, password managers, cloud CLI tools, SSH keys, and .env files. On a developer's machine, that's not just a stolen Netflix password — it's a potential path into cloud consoles, source repos, and production systems.

It also ships with a tiered mutation engine that rewrites its own binary on every build, making static antivirus signatures far less reliable.

Varonis Threat Labs uncovered it after analyzing the operator panel and builder directly — important context, since the findings come from the vendor's own tooling, not a confirmed live infection.

In this piece, I break down how it works, the published IOCs, PowerShell detection commands SOC teams can use today, and a prevention checklist that doesn't require new tooling.

Read the full analysis: https://www.xpert4cyber.com/2026/07/dolphin-x-malware-ai-stealer.html