Dolphin X is a remote access trojan that uses an AI-driven profiling system embedded in its operator panel to automatically score and rank infected users based on collected data such as app usage, risk factors, and browser activity. This enables attackers to prioritize victims who may provide access to valuable accounts, cryptocurrency, corporate networks, or cloud environments. The malware also includes credential-stealing functionality targeting a wide range of applications, including browsers, crypto wallets, password managers, and cloud command-line tools. The AI Profiler generates daily summaries with ranked victim profiles to assist attackers in triaging targets. The analysis was conducted by Varonis Threat Labs on the malware builder and operator panel, without executing a live sample, so some advertised capabilities remain unconfirmed. The AI engine used for profiling is unknown. This represents an evolution in malware operational efficiency by leveraging AI to automate victim prioritization.

The malware enables attackers to steal credentials from a broad set of applications and accounts, potentially compromising sensitive personal, financial, and corporate data. The AI-powered profiling feature increases the operational efficiency of attackers by automating the identification of high-value victims, which could lead to more targeted and impactful follow-on attacks. This can result in unauthorized access to cryptocurrency wallets, cloud environments, production systems, and corporate networks. The use of AI for victim triage may increase the speed and scale of successful intrusions.

As this is malware rather than a software vulnerability, no patch or official fix is applicable. Organizations should focus on standard malware defense strategies such as endpoint protection, network monitoring for suspicious activity, credential hygiene, and user education to prevent infection. Since the malware is distributed via cybercrime forums and requires infection to operate, preventing initial compromise is critical. There is no vendor advisory or patch available for this threat. Security teams should remain vigilant for indicators of compromise related to Dolphin X and apply threat intelligence updates accordingly.