A new remote access trojan (RAT) named Dolphin X is being advertised on cybercrime forums, claiming to incorporate an AI-powered profiling feature designed to rank infected users by value. This functionality aims to help attackers prioritize victims for further exploitation.
The malware was analyzed by Daniel Kelley, a researcher at Varonis Threat Labs, after it was promoted by a vendor using the alias "Kontraktnik" as an all-in-one RAT. Varonis obtained and examined the Dolphin X operator panel and builder in an isolated lab environment, along with its network traffic. The researchers did not execute a live Dolphin X agent on an infected machine.
The operator panel for Dolphin X reportedly lists 329 features across ten categories. Among these, a credential-stealing component is advertised to target over 300 applications. However, the most distinctive feature highlighted is an "AI Profiler," which purports to analyze data collected from compromised systems to assign each victim a "risk score."
According to Varonis, the seller describes the AI Profiler as an "AI behavioral profiler with app usage tracking, risk score, and daily summary." This feature is intended to automate the process of sifting through potentially thousands of stolen credentials and other data to identify high-value targets. The operator panel claims the AI Profiler can process application usage, risk scores and tags, browser domains, and installed software to generate ranked profiles.
These profiles are then presented to attackers in daily summaries, allowing them to focus on machines that might offer access to valuable accounts, cryptocurrency, corporate networks, cloud environments, or production systems. Kelley noted that the feature appears designed to assist operators in triaging victims.
Varonis confirmed the presence of the AI Profiler option within the operator panel and discovered technical strings supporting the profiling workflow, including "Auto-Start AI Profiler," "ProfilerStart," "ProfilerGetData," "risk_score," "risk_factors," and "categoryusage." These strings suggest that the profiling workflow is indeed integrated and that the panel is equipped to process the necessary data for ranking victims. However, without analyzing a live Dolphin X malware sample, Varonis could not determine the specific artificial intelligence engine used to produce these rankings.
Beyond the AI Profiler, Dolphin X is advertised as a credential stealer. The operator panel indicates it targets a wide range of applications, including nine Chromium and Gecko browsers, 100 cryptocurrency wallet extensions, 65 desktop crypto wallets, 10 password managers, and more than 30 cloud command-line tools. The malware also claims to steal .env files, SSH keys, cloud access tokens, browser login data, cryptocurrency wallet information, and other developer credentials. As Varonis did not execute a live malware sample, these advertised collection capabilities were not independently verified by the researchers.
The use of artificial intelligence by threat actors has become increasingly common, with AI being leveraged for various cybercrime services and even autonomous attacks. Dolphin X, in this context, appears to apply AI to an operational challenge, aiming to process large volumes of stolen data and automatically categorize infected users based on their potential value.
