AI-powered malware targets 300+ apps to maximize what one infection pays

Dolphin X doesn't just steal your data. It sorts it. The Windows infostealer, advertised on a cybercrime forum by a vendor using the handle "Kontraktnik," now ships with an "AI Profiler" that, per Varonis Threat Labs' lab review and the exclusive in The Register, grades each infected machine on app usage, browsing activity, and installed software, then hands the operator a ranked shopping list of which credentials, browser cookies, and crypto-wallet keys to flip first.

An infostealer is a category of malware that scrapes saved logins, browser cookies, session tokens, and wallet files from an infected host and exfiltrates them to a remote panel. The "AI Profiler" sits on top of that exfiltration pipeline. Rather than dumping a raw credential archive on the buyer, the operator panel sorts the loot before it leaves the victim's machine, so a single infection arrives at the marketplace as graded inventory instead of a junk-drawer spill.

The builder that Varonis dissected in an isolated lab exposes 329 features in 10 categories and credential looting across 300+ applications, according to Varonis's writeup. That inventory breaks down as 9 browsers, more than 100 browser-based crypto-wallet extensions, 65 desktop wallets, 10 password managers, and 30 cloud command-line tools. An independent technical deep-dive on Substack corroborates the advertised feature set and links the "Kontraktnik" handle to prior projects called "Cash RAT" and the "Cashout" autoshop.

The vendor's sales thread on the forum had passed 3,000 views by the time The Register published, with at least two confirmed buyer transactions logged, per The Register.

The "AI Profiler" label is the panel's own. Varonis's lab analysis describes it as a scoring layer that weighs which apps the victim actually uses, which sites they visit, and what is installed on the machine, then delivers a daily summary ranking infected hosts for operator triage. The underlying model or heuristic is not publicly documented, so the "AI" claim is best read as panel-stated behavior, a sorting layer exposed in the operator user interface, rather than a confirmed machine-learning pipeline. Varonis did not run a live sample, so capability claims beyond the panel and captured traffic are vendor-advertised, not independently observed in execution.

A Dolphin X operator paying $230 a month no longer has to comb a raw dump for the one bank session, the one hardware-wallet seed, or the one cloud admin token. The panel tells them which machine in their portfolio is worth touching first.

The Register reports three monthly tiers, all advertised in U.S. dollars: roughly $80, $230, and a higher-priced top tier, plus lifetime licenses around $1,140, $2,280, and $3,420. The Substack's technical deep-dive lists the same tier shape in euros; the dollar figures are The Register's reported conversion.

The basic tier rewrites PE timestamps, Rich headers, and section padding; the mid tier adds import-table shuffling; and the top tier claims control-flow rewrite, instruction substitution, and per-build string re-encryption, per Varonis. The mutation engine is opt-in. With mutation off, builds are compiled server-side at backend.thedolphinx[.]top:8443 and ship with the same hash across customers. With it on, each binary gets a per-build edit before delivery. That is the actual reason operators pay for the upper tiers: not the obfuscation depth in isolation, but the fact that a single payload stays reusable across many buyers without burning a hash-based detection rule.

Dolphin X is Windows-only at time of research; the vendor claims a Debian port is in progress. Localization is English plus Russian, and a CIS-country skip option is exposed in the builder, per Varonis. That combination, Russian-language strings, a Russian-speaking forum presence, and a built-in skip for Commonwealth of Independent States (CIS) countries, is consistent with Russian-speaking operators, though it is suggestive attribution, not confirmed.

Varonis's defender takeaways come down to one line: behavioral detection, not hash matching. Because the mutation engine is opt-in and the default build is hash-stable across operators, a YARA rule written today can keep matching Dolphin X binaries for as long as the panel ships the same default. A customer who flips the mutation toggle on burns that signature in a single purchase. The more durable signal is behavior at the operator end: an explorer.exe running under a non-default desktop is a usable indicator that a Hidden Virtual Network Computing (HVNC) session is being driven against an infected host, because the panel's hidden-desktop view is the actual triage surface where the operator reads the AI Profiler's ranking.

The AI-in-malware pattern is also not unique to Dolphin X. Varonis previously documented Bluekit, a phishing kit with an AI component, and SpamGPT, an email attack tool with an AI component, as earlier examples of AI-augmented commodity crimeware. The novelty here is placement. The AI sits on the panel side and ranks victims before resale, not on the victim side during infection. That moves the unit of trade from raw credential dump to graded inventory, and it is the structural change a defender has to plan around, rather than the AI label on the brochure.

The next concrete watch item is the Debian port. A second operating system would more than double the panel's reachable install base. If Varonis or The Register confirm a working Linux binary in the next vendor update, the defender calculus changes from "behavioral detection of Windows HVNC" to "behavioral detection on two operating systems at once."