A New Frontier in Automated Cybercrime

Security experts at Varonis Threat Labs have identified a sophisticated remote access trojan (RAT) dubbed Dolphin X. While malware has long been used to gather data, this new tool integrates artificial intelligence to prioritize victims, a development that marks a significant shift in the cybercriminal landscape.


Comprehensive Threat Capabilities

Dolphin X is highly versatile, operating as an infostealer, a DDoS botnet, an HVNC (Hidden Virtual Network Computing) tool, and a loader. Its data theft capabilities are particularly extensive, covering over 300 different applications. It is designed to harvest:

  • Browser passwords and enterprise credentials
  • Cryptocurrency wallet information
  • DevOps secrets and SSH keys
  • Cloud tokens and sensitive personal files

The malware boasts 329 distinct features organized into 10 separate categories, making it a formidable tool for bad actors.


The AI Profiler: Targeting Made Easy

The most alarming component of the software is the "AI Profiler." This feature analyzes the behavior of an infected system, including browsing history and application usage patterns. It then compiles and transmits daily reports to the attacker, allowing them to focus their efforts on victims who are most likely to yield valuable data or access to corporate environments.

«Dolphin X's collection scope reaches well beyond browser passwords to SSH keys, cloud tokens, and DevOps credentials. On the wrong machine, a single infection could expose access to an entire production environment»

Dark Web Commercialization

Dolphin X is currently being marketed on dark web forums through a subscription-based model. Interested criminals can choose from several tiers:

  • Basic Tier: $80 per month
  • Top Tier: Approximately $230 per month

For those seeking long-term access, lifetime subscriptions are available, ranging from $1,140 for the base version up to $3,420 for full-feature access. Experts note that the integration of AI into such commercialized malware kits highlights a growing trend of professionalization within the cybercrime industry.