Overview
- Varonis Threat Labs disclosed Dolphin X after obtaining its operator panel and builder, showing a dashboard feature called an “AI Profiler” that scores and ranks infected machines for attackers.
- The panel lists 329 features across ten categories and advertises credential theft from more than 300 apps, including browsers, crypto wallets, .env files, SSH keys and cloud tokens.
- The disclosure, reported July 23 by multiple security outlets, showed profiling strings such as ProfilerStart and risk_score that indicate an automated victim‑triage workflow in the panel.
- Researchers did not execute a live Dolphin X sample, so the profiler’s underlying AI model, the accuracy of its rankings, and the malware’s claimed live collection behavior remain unconfirmed.
- The malware is being sold on cybercrime forums with tiered subscriptions, and Varonis urged defenders to remove long‑lived credentials from disk and focus detection on anomalous behavior like hidden remote desktop sessions.