Meet Dolphin X: The Infostealer With an AI Profiler That Tells Crooks Which Victims Are Worth Robbing First

A new Windows infostealer has turned up on a cybercrime forum with a feature that researchers say they haven't seen before: an AI-powered profiler that ranks infected victims by likely payout, so attackers know exactly where to focus their energy.

Varonis Threat Labs spotted the malware, dubbed Dolphin X, and shared their findings exclusively with The Register. It's a combined infostealer and remote access trojan (RAT), and whoever built it wasn't cutting corners.

The thing targets over 300 applications and claims it can bypass browser password protections, harvest enterprise credentials, drain cryptocurrency wallets, and hoover up SSH keys, cloud tokens, .env files, and DevOps secrets. Basically, if it's sensitive and sitting on a Windows machine, Dolphin X wants it.

But the standout feature is the AI Profiler. It monitors infected machines, scoring victims based on their installed software, app usage patterns, and browsing history. The results get packaged into a daily summary sent to the operator, ranked by how lucrative each target looks. It's essentially a prioritisation engine for criminals.

Daniel Kelley, senior threat researcher at Varonis, called the AI Profiler something he'd genuinely never seen before, and described the malware as covering one of the largest attack surfaces he's encountered in this space.

The malware is being sold by someone operating under the alias "Kontraktnik", who pitches it as a multi-purpose tool: stealer, Hidden Virtual Network Computing (HVNC) client, DDoS botnet, and loader, all in one package. The sales thread has clocked over 3,000 views and at least two confirmed purchases, both with positive buyer feedback.

Currently Windows-only, though the developer claims Debian support is in the works. The malware also includes an option to skip infecting machines in Commonwealth of Independent States countries, which is a classic hallmark of Russian-based cybercrime operations. Kelley suspects the developer is Russian-speaking.

Varonis analysed the malware builder, operator panel, and network traffic, but didn't get hold of a live sample to test. That means they can't independently verify every claim the developer makes. That said, Kelley noted the builder contained everything consistent with the advertised features being real, and buyer feedback supports that assessment.

Priced Like SaaS, Packaged for Amateurs

Dolphin X runs on a three-tier subscription model. The entry-level plan costs around $80 per month and includes obfuscation tools that modify PE timestamps, Rich headers, and section padding, plus capabilities designed to trip up signature-based detection systems like YARA rules and hash blocklists.

The mid-tier adds import table shuffling, which changes the binary's import hash between builds, making static analysis harder. The top tier, at roughly $230 per month, goes further: control flow rewriting, instruction substitution, and re-encrypting embedded strings with a fresh random key on every build. That's a meaningful amount of anti-analysis capability baked in at the product level.

For those who prefer a one-off payment, lifetime licences run from around $1,140 at the basic tier to $3,420 for the full pro version.

The economics here matter. Kelley pointed out that until fairly recently, deploying this kind of tooling required genuine technical skill. Now it's subscription software. Anyone with a credit card and bad intentions can pick it up and run with it.

What Defenders Should Actually Do About This

Varonis offers two practical takeaways. First, stop storing long-lived credentials on disk wherever possible. Infostealers are designed to grab everything in a single sweep, so anything sitting locally should be treated as already compromised.

Second, and more importantly, shift detection focus from file signatures to behaviour. Dolphin X and tools like it are built specifically to sidestep signature-based defences. The report flags that explorer.exe running under a non-default desktop is a reliable indicator of an HVNC session, regardless of how the malware has been packed or what hash it's carrying.

Dolphin X isn't Varonis' first encounter with AI-assisted crimeware. The team previously uncovered Bluekit, a phishing kit, and SpamGPT, an email attack tool. The pattern is consistent: criminals are finding practical uses for AI faster than most legitimate organisations, and they're using it to make their operations more efficient.

Not a great trend.