Dolphin X Shows How AI Helps Criminals Prioritize the Most Valuable Compromised Devices

Varonis Threat Labs published an analysis of a new Windows malware tool called Dolphin X. It is advertised on cybercrime forums as both an information stealer and a remote access trojan — RAT (Remote Access Trojan).

The topic matters because Dolphin X is not limited to stealing browser passwords. According to the analysis, the tool is designed to collect data from more than 300 applications and help operators rank infected devices by likely value through a feature called AI Profiler.

This does not mean the malware operates fully autonomously. The more important point is different: artificial intelligence is now being used not only to create or execute attacks, but also to process stolen information and prioritize the most valuable targets.

What Is Confirmed

Varonis discovered Dolphin X while tracking an advertisement on a cybercrime forum by a seller using the alias “Kontraktnik.” Researchers analyzed the tool’s operator panel, malware builder and related network traffic in an isolated laboratory environment.

According to Varonis, Dolphin X is designed to collect data from a wide range of applications and local stores. The operator panel lists more than 300 targets for credential theft and other sensitive data collection.

Potential targets include browsers, cryptocurrency wallet extensions, desktop cryptocurrency wallets, password managers, SSH keys, .env files, cloud tokens, cloud command-line tools, developer environment data and saved login data.

This makes Dolphin X risky not only for individual users, but also for organizations. One infected device belonging to a developer, administrator or finance employee may expose access to cloud environments, code repositories, internal systems or production infrastructure.

Important Clarification

Varonis explicitly states that it analyzed the Dolphin X operator panel, builder and network traffic, but did not observe the full malicious agent running on an infected machine.

This means that some capabilities are visible in the panel or described in the seller’s documentation, but not all of them were independently confirmed during a live infection.

This distinction matters. The topic should not be framed as sensational proof of an “AI virus” that automatically selects and attacks victims. The more accurate takeaway is that criminal tools are beginning to include AI to improve ranking, assessment and processing of already collected information.

How AI Profiler Works

The most distinctive feature in Dolphin X is AI Profiler. According to Varonis, it analyzes data from the infected device and assigns a score that helps the operator decide which victims deserve attention first.

The feature may use information such as applications in use, browsing history, installed software, tags and other collected data from the system.

Operators then receive a daily summary of ranked profiles. Instead of manually reviewing a large number of infected devices, they can focus on the systems that appear most valuable.

For criminals, this is an efficiency problem. If a campaign infects thousands of devices, automated scoring can direct attention toward developers, administrators, finance employees, cryptocurrency holders or users with access to corporate and cloud systems.

Why This Matters for Organizations

Dolphin X shows how credential theft is becoming a more operationalized process. Attackers are not simply collecting passwords. They are looking for access that can be used for the next step.

The most valuable devices are those that may contain cloud tokens, SSH keys, .env files containing secrets, access to code repositories, cloud infrastructure management tools, administrative passwords, financial data, cryptocurrency wallets or active browser sessions.

This type of theft can lead to account takeover, cloud infrastructure access, data exfiltration, code changes, build process compromise or movement toward internal systems.

Risk Around Developer and Administrator Devices

Developer, system administrator and DevOps devices are especially valuable targets. They often contain local files, keys and tokens that provide access to sensitive environments.

Examples include .env files in project directories, SSH keys, long-lived cloud tokens, local configurations for cloud service access, code repository data, saved browser sessions and automation keys.

If these data points are stolen, the incident may move beyond one endpoint. It may affect cloud accounts, applications, internal systems and customer data.

What Should Be Checked

For organizations, the practical question is not only whether there are indicators of Dolphin X. The more important question is whether one infected device can provide access to more critical systems.

Security teams should pay attention to:

• locally stored tokens, SSH keys and .env files;
• unusual reading or archiving of sensitive files;
• access to password managers and browser profiles;
• cloud logins after an endpoint incident;
• developer and administrator devices with elevated access;
• a fast process for rotating keys, tokens and passwords when compromise is suspected.

The main takeaway is practical: if a device is infected with an information stealer, all sensitive data stored locally on that device should be treated as exposed.

DIAMATIX Perspective

Dolphin X shows how criminal tools are starting to use artificial intelligence not only for attack execution, but also for decision-making after compromise.

Defence should focus on what can be stolen from a single endpoint and how that access can be used afterward. A password, token or SSH key from a developer laptop may become a path into a cloud environment, code repository or production system.

DIAMATIX treats cases like this as a visibility issue across endpoints, credentials and follow-on activity. SOC (Security Operations Center) and MDR (Managed Detection and Response) processes need to connect local endpoint behavior with cloud logins, token usage and unusual actions after initial infection.

CISO Analysis

For CISOs, the key question is whether the organization knows what sensitive data is stored locally on work devices.

Key questions to review:

• Which employees store SSH keys, tokens or .env files locally?
• Do developers and administrators use long-lived credentials?
• Can we detect mass reading or archiving of sensitive local files?
• Do we monitor token use in cloud environments after an endpoint incident?
• Do we rotate credentials after endpoint infection?
• Can the SOC connect endpoint activity with follow-on cloud access?

The practical takeaway: with modern information stealers, the infected device is not the end of the incident. It may become the starting point for access to cloud environments, code, data and production systems.

Check whether local credentials can open a path to critical systems

DIAMATIX can help review endpoint risk, stored tokens, SSH keys, .env files and follow-on logins to cloud or internal systems.

Request a credential theft risk review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Varonis Threat Labs. Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI.
• The Register. Sneaky Windows stealer targets 300+ apps, gives criminals an AI profiler to maximize profits.
• Infosecurity Magazine. New Dolphin X stealer employs AI profiling to prioritize targets.
• Cyber Security News. New Dolphin X Malware Steals Credentials From 300+ Apps and Profiles Victims With AI.

This article is based on publicly available information as of July 2026. Dolphin X capabilities are presented with the clarification that Varonis analyzed the operator panel, builder and network traffic, but did not observe a full infection running on a live machine.