Dolphin X uses AI to prioritize victims and steals data from over 300 applications

New malware combines extensive data theft, remote access, and AI-based profiling

A new malware called Dolphin X has been identified by Varonis Threat Labs. According to researchers, it combines information theft and remote access capabilities with AI-based profiling that helps attackers identify the most valuable victims. The tool is said to be able to collect sensitive information from more than 300 applications and targets everything from browsers and password managers to crypto wallets, cloud services and development environments.

The researchers describe Dolphin X as an example of how cybercriminals are increasingly using automation and AI to streamline their attacks. The goal is not only to steal information, but also to quickly determine which infected systems will yield the greatest financial dividends.

Promoted on cybercriminal forums

Varonis Threat Labs discovered Dolphin X after the tool was marketed on a cybercrime forum by an actor with the alias “Kontraktnik.” According to the ad, it offers a complete platform for information theft and remote access, where the attacker can create their own clients with different functions depending on their needs.

The researchers analyzed the operator panel and its network traffic in an isolated analysis environment to better understand how the platform works. The analysis focused on the admin tools and infrastructure behind the service, not on an active infection of a victim.

Extensive data collection

One of the most notable features is the scope of information that can be collected.

According to Varonis, supports Dolphin X collection from over 300 different applications. Among the data that can be stolen are:

• Saved browser logins
• Session cookies
• Cryptocurrency wallets and wallet add-ons
• Password manager
• SSH keys
• .env files
• Cloud tokens and credentials
• DevOps-related configuration files

For developers and IT administrators, this poses a particularly high risk. Locally stored credentials and keys can give attackers access to cloud platforms, CI/CD environments, production systems, and other critical infrastructure.

The researchers note that a single compromised workstation can in some cases provide access to significantly larger parts of an organization's IT environment.

AI is used to prioritize valuable victims

One feature that particularly stands out is the built-in AI-based profiling.

The operator panel describes the feature as a tool that analyzes the victim's installed software, user behaviors, and activity patterns to calculate a risk or value score. The results are presented in daily summaries that allow the attacker to prioritize which infected computers to scan first.

In practice, the system acts as an automated prioritization tool. Instead of manually going through thousands of infected computers, the operator can quickly identify the systems that are likely to contain the most valuable data.

According to Varonis This shows how AI is increasingly being used to streamline cybercrime, not through more advanced malware but by helping attackers make faster decisions.

Remote compilation and code mutation

The researchers also describe how Dolphin X is built.

Instead of creating the finished malicious code locally, the operator sends its configuration to the vendor's backend server where the client is compiled. The configuration may include:

• Command and Control Server (C2)
• Installation location
• Persistence methods
• Avoidance techniques
• Other features to be activated

This means that the supplier has the opportunity to modify each created binary file before it is delivered back to the customer.

The system also offers multiple levels of code mutation that aim to make each built client more difficult to identify with traditional signature-based security products. Techniques described include rewriting control flows, changes to import tables, and modification of metadata and other parts of the PE file.

Although some features require a higher subscription level, the solution demonstrates how commercially developed malware continues to become increasingly sophisticated.

Focus on behavior-based detection

Varonis emphasizes that traditional file signatures and hash values are becoming less and less reliable as malware continually changes through automated mutation.

Instead, the researchers recommend that security teams focus on behaviors that deviate from the norm, such as unusual processes, suspicious desktop sessions, unexpected system calls, or activities that indicate data collection and exfiltration.

The researchers also recommend that organizations minimize the amount of persistent credentials stored locally. If sensitive keys, tokens, or configuration files are stored on a compromised computer, an attacker can quickly gain access to significantly larger parts of the organization's infrastructure.

Mapped against MITRE ATT&CK

Varonis has also connected Dolphin X functions to several techniques in the MITRE ATT&CK framework.

Among the identified technologies are:

• Theft of browser data
• Collection of credentials from password managers
• Theft of SSH keys and authentication files
• Archiving stolen information
• Process injection
• UAC bypass
• Persistence via the registry and scheduled tasks
• Manipulation of security features such as AMSI and ETW
• Obfuscation and code mutation
• Proxy functions for network traffic

The mapping can be used by security teams to improve detection and incident management.

AI is also changing the way attackers work

Dolphin X shows that AI is no longer just used to create content or write code. The technology is now also being used to automate parts of the attackers' decision-making processes.

By combining extensive data collection with AI-based prioritization, cybercriminals can more quickly identify the most profitable targets and focus their resources where they will have the greatest impact.

For organizations, this means that protecting identities, credentials, and development environments is becoming increasingly important. At the same time, there is a growing need for behavioral monitoring that can detect suspicious activity even when the malicious code changes between attacks.