Dolphin X: The New Malware That Uses AI to Pick Which Victims to Rob First
A remote access trojan sold on a cybercrime forum claims to score infected machines by their value, so criminals can go after the richest targets first.
Key points
- Varonis Threat Labs found a new malware called Dolphin X being sold on a cybercrime forum by a vendor using the name Kontraktnik.
- The malware includes an "AI Profiler" that ranks infected computers by value to attackers, delivering daily summaries of the highest-priority victims.
- The operator panel lists 329 features across ten categories and claims to steal credentials from more than 300 applications, including 100 cryptocurrency wallet extensions and 30 cloud command-line tools.
- Varonis studied the builder and network traffic but did not run a live sample, so advertised capabilities are unverified.
- Dolphin X specifically targets developer secrets like .env files, SSH keys, and cloud access tokens: the credentials that open production systems.
There's a new piece of criminal software making the rounds, and it comes with a sales pitch straight out of a marketing deck. It's called Dolphin X, and its authors say it uses artificial intelligence to tell criminals which of their victims are worth robbing first.
The malware was spotted by researcher Daniel Kelley at Varonis Threat Labs, who found it advertised on a cybercrime forum under the seller alias "Kontraktnik." First reported by BleepingComputer, the tool is a remote access trojan, meaning software that quietly gives an attacker full control of an infected computer.
What does the AI actually do?
It sorts victims. When criminals infect thousands of machines, they drown in stolen passwords and files, most of it junk. The AI Profiler reads what apps a person uses, what sites they visit, and what software is installed, then hands the operator a ranked list each day of who's worth attacking further.
Think of it as a filter that flags the accountant with access to the company bank account, or the developer whose laptop holds the keys to a cloud server. The seller describes it as an "AI behavioral profiler with app usage tracking, risk scoring, and daily summary."
Kelley found technical strings in the panel, including ProfilerStart, risk_score, and risk_factors, which suggest the sorting workflow is genuinely wired in. What Varonis couldn't confirm is which AI engine produces the rankings, because the team examined the builder and its traffic logs rather than detonating a live sample.
What is it trying to steal?
Almost everything of value on a modern machine. The operator panel claims Dolphin X targets more than 300 applications. The failure mode is depressingly familiar to anyone running cloud workloads: it goes straight for developer secrets.
| Target category | Number claimed |
|---|---|
| Browsers (Chromium and Gecko) | 9 |
| Cryptocurrency wallet extensions | 100 |
| Desktop crypto wallets | 65 |
| Password managers | 10 |
| Cloud command-line tools | 30+ |
On top of that, the malware advertises theft of .env files (plain-text files developers use to store passwords and API keys), SSH keys (the credentials engineers use to log into servers), cloud access tokens, and browser login data. One infected developer laptop can hand an attacker the keys to an entire production environment. We covered a similar developer-credential threat on 15 July in two poisoned coding tools that hijacked JavaScript packages.
Should ordinary people be worried?
Not directly, but yes indirectly. Dolphin X is aimed at people who hold crypto wallets, corporate logins, or cloud admin access. If you're that person, assume any infostealer infection is now being triaged automatically. Rotate credentials, treat unusual software prompts with suspicion.
For everyone else, the risk is second-hand: the companies holding your data are the ones being ranked by these tools. When a major breach lands and the postmortem asks how the attacker knew which stolen session to use, the answer may well be that something like Dolphin X told them.
The plain judgement
AI is now doing the boring operational work of cybercrime: sorting, triaging, prioritising. The uncomfortable part isn't the credential theft, which infostealers have done for years. It's that your stolen data is no longer sitting in a text file waiting to be forgotten. Something is reading it, scoring it, and putting it at the top of a queue. That's a qualitatively different problem, and vendors who lead with "AI-powered detection" without addressing stolen-session abuse are selling half a solution.
