Loading story…
Varonis Threat Labs reported that Dolphin X, a Windows information stealer and remote-access trojan sold on a cybercrime forum by the actor "Kontraktnik," is designed to harvest data from more than 300 applications. Advertised targets include browser passwords, enterprise credentials, cryptocurrency wallets, password managers, .env files, SSH keys, cloud tokens, and other DevOps secrets, creating risk for both personal accounts and corporate cloud environments. Researchers said the malware is offered in multiple subscription tiers and appears tailored for broad credential theft rather than simple consumer-focused infostealing.
The operation stands out for an "AI Profiler" in its operator panel that scores infected users by likely value based on installed software, browsing activity, and application usage, helping criminals prioritize the most profitable victims. Varonis also found that builds are compiled remotely through backend.thedolphinx[.]top:8443 and can use mutation features such as PE rewriting, import-table shuffling, control-flow rewriting, and string re-encryption to frustrate signature-based detection. While the researchers analyzed the builder, panel, and network traffic rather than a live malware sample, they assessed many of the advertised capabilities as credible and advised defenders to reduce long-lived credentials stored on disk and rely more heavily on behavior-based detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Varonis publicly disclosed that Dolphin X includes an "AI Profiler" to rank infected users by likely value and is designed to steal browser passwords, enterprise credentials, cryptocurrency wallets, .env files, SSH keys, cloud tokens, and DevOps secrets. The disclosure highlighted anti-detection features such as binary mutation and code rewriting intended to evade signature-based defenses.
Varonis Threat Labs analyzed Dolphin X through its builder, operator panel, and network traffic rather than a live malware sample. The researchers identified remote build infrastructure at backend.thedolphinx[.]top:8443 and assessed that many of the malware's advertised capabilities appeared legitimate.
Varonis reported that the Windows infostealer and RAT Dolphin X was being sold on a cybercrime forum by a seller using the alias "Kontraktnik." The malware was marketed in subscription tiers and advertised theft capabilities against more than 300 applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcevaronis.com
Open sourcetheregister.com
Open sourcevaronis.com
Open sourcevaronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that **ScarCruft**—also tracked as **APT37** or **Reaper**—used a previously undocumented Windows backdoor called **Dolphin** in intrusions targeting South Korea, including a 2021 watering-hole attack against a South Korean online newspaper. The malware was delivered as a selective second-stage payload through a multistage loader chain that used a downloaded Python 2.7 interpreter, XOR-encrypted shellcode, process injection, and persistence via **Run** registry keys and a scheduled task. Dolphin used **Google Drive** for command-and-control and data exfiltration and supported file theft from fixed, removable, and portable drives, keylogging, screenshots, shell command and shellcode execution, and browser credential theft. ESET said earlier variants also altered victims’ signed-in Google and Gmail security settings to maintain inbox access through IMAP and less secure app access, while later versions added evasion features such as dynamic API resolution and string obfuscation and temporarily removed credential-stealing functions; the activity was observed from April 2021 through January 2022 and attributed to the North Korea-aligned espionage group’s long-running focus on South Korean and other regional targets.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026