Dolphin X Trojan Uses AI to Rank Victims by Value

Varonis Threat Labs researcher Daniel Kelley discovered an advertisement on a cybercrime forum for a new remote access trojan called Dolphin X. The seller, hiding behind the alias “Kontraktnik,” is promoting it as an all-in-one universal tool: the operator panel lists 329 features grouped into ten categories.

The most notable of them is the so-called “AI Profiler.” The seller describes it as a “behavioral AI profiler with application usage tracking, risk scoring, and a daily summary.”

Why criminals sort their victims

Malware that steals credentials can harvest logins and passwords for hundreds, even thousands, of accounts in a short time. Sifting through that mountain by hand to figure out where the truly valuable haul is hidden is no easy task. Dolphin X, according to its authors, automates this drudgery: it scores, categorizes, and ranks infected computers so operators can see at a glance who to go after first.

The profiler takes into account the applications in use, risk scores and tags, the domains visited in the browser, and the installed software. The output comes as daily summaries with a ranked list of victims. Priority goes to machines that lead to valuable accounts, cryptocurrency, corporate networks, cloud environments, or production systems. According to Kelley, in practice the feature serves to “triage” victims.

What could be confirmed

Varonis studied not a live sample running on an infected machine, but the operator panel, the builder, and the network traffic in an isolated lab. The researchers found technical strings confirming the presence of a profiling workflow: Auto-Start AI Profiler, ProfilerStart, ProfilerGetData, risk_score, risk_factors, and categoryusage. That said, without analyzing a live sample they were unable to determine exactly which AI engine generates the ratings. For the same reason, the researchers did not independently verify the claimed data-collection capabilities.

Besides the profiler, Dolphin X also works as a classic stealer, targeting, according to the seller, more than 300 applications: 9 browsers based on the Chromium and Gecko engines, 100 cryptocurrency extensions, 65 desktop crypto wallets, 10 password managers, and over 30 cloud CLI tools. It separately mentions the theft of .env files, SSH keys, cloud access tokens, and other developer credentials.

Artificial intelligence has long since settled into the attackers' arsenal — from services like SpamGPT to autonomous AI agents that carry out attacks. Dolphin X takes a different route: instead of the attack itself, AI handles an operational task — churning through mountains of stolen data and sorting victims into neat piles, singling out the most “profitable” ones.

Source: Bleeping Computer