Dolphin X Trojan Uses AI to Rank Victims by Value for Cybercriminals
A new remote access trojan called Dolphin X claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims to target first. The malware appears on a cybercrime forum under the vendor alias "Kontraktnik" and promotes itself as an all-in-one tool. Varonis Threat Labs researcher Daniel Kelley analyzes the malware and finds that its operator panel lists 329 features across ten categories, including a credential-stealing function that targets more than 300 applications.
The standout capability is an "AI Profiler" that analyzes data collected from infected computers and assigns each victim a risk score. The tool processes application usage, browser domains, installed software, and behavioral patterns to produce ranked victim profiles. Attackers receive daily summaries containing these rankings, allowing them to quickly identify machines that may grant access to valuable accounts, cryptocurrency wallets, corporate networks, or cloud environments.
Varonis obtains the Dolphin X operator panel and examines it in an isolated lab, studying the malware builder and its network traffic rather than executing a live agent. The researcher confirms that the AI Profiler exists in the panel and discovers technical strings that support the profiling workflow. This innovation addresses a long-standing challenge for cybercriminals who steal credentials from thousands of accounts and struggle to manually identify the most lucrative targets.