Dolphin X: an infostealer that profiles victims with AI

Researchers at Varonis Threat Labs (Daniel Kelley) have detailed new Windows malware called Dolphin X — a combination of infostealer and remote access trojan. What sets it apart is not only the breadth of theft (over 300 applications) but how it is marketed: the vendor boasts of AI-powered victim profiling meant to indicate who to rob first.

Caution is needed here, so let us separate two things immediately: the analysis of its theft capabilities is a researcher finding, whereas “AI” is primarily a marketing claim by the malware’s author on a crime forum. Both are worth understanding separately.

What Dolphin X actually steals

The scope is broad and clearly aimed at high-value targets:

• 9 browsers (credentials, sessions),
• over 100 cryptocurrency wallet extensions and 65 desktop wallets,
• 10 password managers,
• 30 cloud CLI tools,
• .env files, SSH keys, and cloud service data.

That list says more than the seller’s claims. Targets such as .env, SSH keys and cloud tooling are not “consumer” loot — they are credentials for access to infrastructure. Dolphin X aims at developer and administrator workstations, because one such machine opens the way into repositories, cloud and production.

The “AI Profiler” — what it really means

According to the description, the feature analyses installed software, browsing activity and application usage, assigns each victim a value score, and then generates daily summaries ranking infected systems. An operator managing thousands of machines can thereby quickly spot developer workstations, cryptocurrency users and other lucrative finds.

Is it “real AI”? That cannot be settled from the outside, and it matters little operationally. The mechanism matters, not the label: criminals have moved from mass data collection to victim triage. Even simple rule-based scoring (is Docker installed? are there SSH keys? is there a wallet?) achieves the same effect — it shortens the time between infection and targeted abuse of the most valuable account.

For defenders the conclusion is uncomfortable: the response window shrinks. Stolen data used to sit in bulk for weeks before anyone reviewed it. With automatic ranking, a valuable victim rises to the top of the list almost immediately.

The scale is still early

Keep a sense of proportion. According to reporting, the listing had over 3,000 views and at least two confirmed sales with positive feedback in late July 2026. That signals early traction on the criminal market, not proof of a mass campaign. There is no basis to write about an epidemic — there is a basis to watch this direction.

What to do

1. Treat developer workstations as critical systems. They hold the SSH keys, .env files and cloud tokens. They deserve the strongest EDR and the shortest patch windows.
2. Move secrets off disk. Instead of .env files and keys in the home directory, use a secrets manager, short-lived credentials and federated authentication. A stolen file then has negligible value.
3. Assume rotation after an incident. If you suspect an infostealer infection, rotate everything that could have been on disk: tokens, SSH keys, sessions, passwords. Antivirus alone does not invalidate stolen data.
4. Remember password managers are a target. That is not an argument against them — they remain the right solution — but for a strong master password, MFA and vault locking. More in our piece on password managers for business.
5. Monitor for leaks of your own data. It is worth regularly checking whether your data has leaked and reacting when company credentials appear.

The bottom line

Dolphin X is best read not as “malware with AI” but as evidence of the industrialisation of credential theft: a broad target set plus automatic victim triage. The “AI” label is marketing, but the shortened time from infection to abuse is real. The defensive fundamentals remain the same as for any infostealer — with emphasis on keeping secrets off disk and rotating fast. If you want to check what is actually sitting on your team’s workstations, get in touch.

---

Sources: BleepingComputer, Varonis Threat Labs, CyberInsider. The description of the “AI Profiler” feature comes from the malware author’s advertising material and has not been independently verified.