Dolphin X is a newly discovered Windows stealer and remote access trojan that targets more than 300 applications, including browsers, cryptocurrency wallets, password managers, and cloud command-line tools. It exfiltrates credentials such as browser logins, SSH keys, .env files, and cloud tokens. The malware includes an AI Profiler feature that automatically scores victims based on application usage, browsing activity, and installed software, enabling attackers to prioritize high-value targets via daily summaries. The malware builder is remotely hosted, compiling agents and offering mutation engines to evade detection. The threat actor behind Dolphin X uses the alias Kontraktnik. This malware poses a significant threat to developers and organizations by potentially exposing access to entire production environments through stolen DevOps credentials. There is no indication of known exploits in the wild or available patches.

The malware enables attackers to steal a broad range of sensitive credentials from infected Windows systems, including browser logins, cryptocurrency wallets, password managers, SSH keys, .env files, and cloud tokens. This can lead to unauthorized access to user accounts, cryptocurrency theft, and compromise of cloud and DevOps environments. The AI Profiler feature enhances attacker efficiency by identifying high-value targets, increasing the risk of impactful breaches. The presence of mutation engines suggests attempts to evade detection, complicating defense efforts. No known exploits in the wild have been reported yet.

No official patches or fixes are available as this is malware rather than a software vulnerability. Mitigation should focus on standard endpoint protection measures including updated antivirus and anti-malware solutions capable of detecting Dolphin X variants. Monitoring for indicators of compromise such as the domains 'thedolphinx.top' and 'backend.thedolphinx.top' and the file hash '726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0' is recommended. Organizations should also enforce strong credential hygiene, multi-factor authentication, and limit exposure of sensitive credentials such as SSH keys and cloud tokens. Since no vendor advisory states otherwise, these steps are prudent.