Dolphin X

The operator sets the agent's C2 address, installation path, persistence, and evasion options, then the client submits the configuration to backend.thedolphinx[.]top:8443, where compilation happens.

The top tier claims to rewrite control flow, substitute instructions, and re-encrypt embedded strings with a fresh key, making stable byte sequences harder to identify.

The minimalist suscription costs about $80 per month, which buys rewriting and altering capabilities across Windows Portable Executable (PE) timestamp, Rich headers, and section padding...

Its collection capabilities include cryptocurrency wallets, .env files, SSH keys, cloud tokens, and other DevOps credentials.

The report warns: “Infostealers are designed to grab everything in one pass, so anything stored locally should be treated as potentially exposed.”

Its collection capabilities include cryptocurrency wallets, .env files, SSH keys, cloud tokens, and other DevOps credentials.

Another feature, called the “AI Profiler,” scores infected users based on their application usage, browsing activity, and installed software.

It scores infected users by app usage, browsing history, and installed software, and sends the cybercriminals a daily summary that ranks victims’ based on the likely payoff from an attack.

Another feature, called the “AI Profiler,” scores infected users based on their application usage, browsing activity, and installed software.

A malware vendor using the alias “Kontraktnik” posted Dolphin X for sale, promising: “You can use it as a stealer, as an HVNC [Hidden Virtual Network Computing]...”

The ad for the malware claims it can target upwards of 300 applications and has the ability to bypass browser passwords and steal enterprise credentials, cryptocurrency wallets, .env files, SSH keys, cloud tokens, and DevOps secrets.

It’s not even just applications. It’s everything, you name it: it will steal files, or credentials, cryptocurrencies.

A single archive can contain data from nine browsers, more than 100 wallet extensions, 65 desktop wallets, 10 password managers, and 30 cloud command-line tools.

The operator sets the agent's C2 address, installation path, persistence, and evasion options, then the client submits the configuration to backend.thedolphinx[.]top:8443, where compilation happens.

A malware vendor using the alias “Kontraktnik” posted Dolphin X for sale, promising: “You can use it as a stealer, as an HVNC [Hidden Virtual Network Computing], as a DDoS botnet, as a loader.”

Varonis Threat Labs spotted the new stealer and remote access trojan (RAT), called Dolphin X...

A malware vendor using the alias “Kontraktnik” posted Dolphin X for sale, promising: “You can use it as a stealer, as an HVNC [Hidden Virtual Network Computing], as a DDoS botnet, as a loader.”