Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI

Summary

Dolphin X is a newly identified Windows-based stealer and remote access trojan capable of targeting more than 300 applications, including browsers, cryptocurrency wallets, and DevOps credentials. One of its standout features is an AI Profiler that scores infected users based on application usage and risk level, allowing attackers to prioritize the most valuable victims. The malware also uses a remote build and mutation engine to evade detection by continuously altering its binary structure.

Investigation

Varonis Threat Labs examined the Dolphin X operator panel within an isolated lab environment. The investigation revealed a remote compilation workflow in which configuration settings are transmitted to a backend service that produces newly mutated binaries. Researchers also captured traffic from the operator-side client, which helped identify the command-and-control infrastructure supporting the malware.

Mitigation

Security teams should prioritize removing long-lived credentials from local disks, especially those stored in project directories or local credential stores. Because Dolphin X can mutate its binaries, organizations should emphasize behavioral detection instead of relying only on file-based signatures. Strong access controls around cloud consoles and software build pipelines are also recommended to reduce the impact of credential theft.

Response

If Dolphin X activity is detected, teams should immediately rotate all potentially exposed credentials, including SSH keys, cloud tokens, and browser-stored passwords. Investigators should also hunt for suspicious process behavior, such as explorer.exe running under non-default desktops. Audit logs should be reviewed for signs of unauthorized access to cloud environments and DevOps tooling.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to disable Windows security instrumentation to facilitate credential theft. To achieve this, they execute a PowerShell command that attempts to patch the AmsiScanBuffer function in memory. By including the string Amsi.dll in the execution context, they trigger the detection rule designed to catch Dolphin X’s signature behavior. This mimics a “Living-off-the-Land” approach where standard tools are used to degrade security posture.

• Regression Test Script:

  # Simulation of Dolphin X AMSI bypass attempt via command line string
  # This is designed to trigger the 'selection_bypass' part of the Sigma rule.
  
  $bypassCommand = "powershell.exe -ExecutionPolicy Bypass -Command "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true); # Targeting Amsi.dll logic""
  
  Write-Host "[+] Executing simulation command to trigger detection..." -ForegroundColor Cyan
  Start-Process cmd.exe -ArgumentList "/c $bypassCommand" -WindowStyle Hidden
  Write-Host "[+] Simulation command dispatched." -ForegroundColor Green

• Cleanup Commands:

  # No persistent changes made; cleaning up any potential artifacts if necessary.
  # In this simulation, we only ran a memory-based command.
  Write-Host "[+] Simulation cleanup complete. No system changes required." -ForegroundColor Yellow