Overview
- Varonis Threat Labs disclosed Dolphin X on Thursday, July 23, 2026 after obtaining the malware’s operator panel and confirming an AI Profiler that scores and ranks infected hosts for attackers.
- The operator panel lists 329 features across ten categories and claims to target more than 300 applications to steal browser logins, crypto wallets, .env files, SSH keys, cloud tokens, and developer credentials.
- Listings on cybercrime forums show subscription tiers for Dolphin X with basic monthly pricing reportedly around $80 and top tiers near $230, plus higher-cost lifetime options.
- Beyond credential theft, the platform advertises multifunction capabilities including hidden VNC access for live control, DDoS botnet functions, and use as a loader, meaning one infection can give broad operational access.
- Varonis advises defenders to remove long-lived secrets from disk and focus on behavior-based detection such as signs of HVNC sessions because packing and hash changes make signature detection unreliable.