Dolphin X: A New Malware That Uses AI to Rank Which Devs to Target First
If you have a .env file or SSH keys sitting in a project folder right now, this one's worth a read.
Varonis Threat Labs just uncovered Dolphin X, a Windows infostealer + RAT sold on underground forums that specifically goes after developer machines. It claims to harvest credentials from 300+ apps in one pass — 9 browsers, 100+ crypto wallet extensions, password managers, cloud CLI tools, SSH private keys, and .env config files.
The part that stands out: it ships with an "AI Profiler" that scores infected machines by value (developer, finance, crypto holder, admin) and sends attackers a daily ranked digest — so instead of manually sifting through stolen data, they know exactly which machine to prioritize.
It also uses a remote build process with a tiered mutation engine (import table shuffling, control-flow rewrites, re-encrypted strings) that changes the binary on every build — meaning hash-based AV detection mostly doesn't work against it.
Practical takeaway for devs: stop storing long-lived secrets in flat files or project directories. Use a proper secrets manager, rotate anything that touched a potentially compromised machine, and enforce MFA on cloud consoles and source control.
I broke down the IOCs, a PowerShell detection command, and a full prevention checklist here:
https://www.xpert4cyber.com/2026/07/dolphin-x-malware-ai-stealer.html
Top comments (0)