Varonis Threat Labs has analyzed the operator panel for Dolphin X, a Windows information stealer and remote access trojan sold on a cybercrime forum. The panel advertises collection from more than 300 applications and includes an “AI Profiler” that can rank infected machines by app usage, browsing activity, installed software, and an operator-defined risk score.
The evidence needs a careful boundary. Researchers obtained the control panel and inspected its network traffic in an isolated lab; they did not report a live victim campaign or execute the final agent on an infected computer. Dolphin X is therefore a credible criminal product under analysis, but its builder claims are not the same as independently observed behavior on a victim endpoint.
What Varonis verified in the Dolphin X panel
The operator client lets a buyer choose a command server, installation path, persistence, and evasion options. Instead of compiling locally, it sends the configuration to backend.thedolphinx[.]top:8443. That remote-build design gives the seller a central point to produce and mutate new binaries.
The panel exposes 329 features across ten categories. Its credential-looter section lists nine browsers, more than 100 wallet extensions, 65 desktop wallets, ten password managers, and 30 cloud command-line tools. It also names .env files, SSH keys, browser data, and other developer credentials as targets.
| Evidence level | What it means |
|---|---|
| Observed by researchers | The operator panel, its configuration sequence, traffic to the vendor backend, AI Profiler controls, and the panel executable hash. |
| Exposed by the builder | Run-key and scheduled-task persistence, process injection, UAC bypasses, AMSI/ETW patching, reverse proxy, browser and wallet theft, and build mutation options. |
| Not established in the report | A current delivery campaign, infection count, final victim-agent hash, named lure, confirmed data theft from a real victim, or whether every advertised function works as claimed. |
Why the AI Profiler changes attacker triage
Commodity stealers can produce more logs than an operator can review manually. Dolphin X’s panel attempts to solve that problem by sorting victims before a human opens each archive. A machine with cloud CLI tokens, SSH keys, wallet software, password managers, or production-related browsing can be moved to the front of the queue.
The “AI” label should not distract from the underlying risk. The dangerous part is the collection scope and ranking process, not proof of an autonomous model making attack decisions. Developers and administrators are especially exposed when long-lived secrets remain in project folders or local credential stores. Our developer-tool malware cleanup guide explains why tokens and repository access must be handled separately from the visible Windows payload.
Indicators are operator-side, not a victim verdict
Varonis published two concrete indicators: the remote-build host backend.thedolphinx[.]top:8443 and SHA-256 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 for the Dolphin X operator-panel executable. Both are useful for threat hunting, but neither is a universal victim-agent signature.
Do not call a PC infected because it contains the word “Dolphin,” a Dolphin emulator, a Dolphin-named browser extension, or unrelated software. The current report also does not publish a Microsoft Defender detection label or a confirmed Dolphin X delivery filename. Correlate a network or file match with its path, signer, parent process, download source, persistence, and account activity.
What to do if a suspicious Windows file ran
- Disconnect the PC from sensitive work. Stop using it for email, banking, password management, crypto, cloud consoles, or code deployment until it is assessed.
- Preserve the original context. Record the filename, path, download URL, archive, alert name, process tree, and time of execution. The Dolphin X report does not provide one universal victim hash, so this evidence matters.
- Run a full malware scan. Check startup entries, scheduled tasks, services, browser extensions, unknown processes, and security exclusions. Removing one visible file may leave a loader or persistence behind.
- From a clean device, rotate secrets in risk order. Start with primary email and the password manager, then revoke browser sessions, OAuth grants, cloud CLI tokens, API keys, SSH keys, wallet approvals, and repository or CI/CD credentials.
- Review downstream access. Check cloud audit logs, source-control access, new SSH keys, mailbox rules, connected apps, wallet transfers, and recovery-setting changes. A password reset alone does not invalidate every stolen cookie or token.
If an unknown installer, crack, job-interview package, or security alert preceded the incident, scan the Windows PC before entering new credentials. Gridinsoft Anti-Malware can check for detected payloads, scheduled tasks, startup entries, browser changes, and other persistence; account and token recovery must still be completed separately.
If a token stealer ran here, logging back in can hand the attacker your new Discord session, email cookie, Steam token, or wallet access. Scan this Windows PC first, then reset passwords from a clean device.
Scan this PC before resetting accountsFor the broader session-recovery sequence after any password stealer, use our 2026 infostealer response guide. If wallet software or a seed phrase was stored on the machine, also review the hot-versus-cold wallet security checklist from a separate trusted device.
FAQ
Is Dolphin X actively spreading right now?
The report confirms a criminal sales listing and an analyzed operator panel, but it does not identify a live distribution campaign, infection count, or named lure. Treat fresh endpoint evidence seriously without inventing a delivery method.
Does the AI Profiler make Dolphin X harder to detect?
Not by itself. The profiler appears to help operators rank collected victims. The panel separately advertises mutation, injection, security-tool patching, and persistence features, but researchers did not validate every final-agent capability in execution.
Should I change passwords immediately on the suspected PC?
No. Clean and isolate the machine first, then change passwords and revoke sessions from a different trusted device. Otherwise an active stealer may capture the new credentials too.
References
- Daniel Kelley. “Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI.” Varonis Threat Labs, updated July 22, 2026, accessed July 23, 2026. Varonis Dolphin X research report.
