Dolphin X Malware Adds AI Profiler to Rank and Prioritize High-Value Victims After Infection
Dolphin X is a new infostealer and RAT for Windows that incorporates an AI Profiler capable of scoring infected machines and ordering victims by value. The idea is to accelerate the transition from mass secret theft to subsequent compromises in accounts, cloud services, and production environments.
The novelty of Dolphin X lies not only in what it steals but in whom it decides to target first. This Windows malware, presented as both an infostealer and remote access trojan, includes a component called AI Profiler that classifies compromised machines, assigns scores, and builds a ranking so operators can concentrate time and resources on the most profitable victims.
The profiling relies on telemetry from the infected machine. This includes signals such as application usage, browser-visited domains, and installed software. From this data the attacker panel generates daily summaries and a priority order that reduces the manual triage work typically required after infection waves.
Operators first examine machines offering the greatest potential return, whether through cloud access, technical profiles, or the presence of sensitive tools. The operator panel showcases the product scope with 329 functions spread across 10 categories, a figure typical of commercial malware families that advertise extensive catalogs even before real-world campaigns are observed.
In the credential theft section, Dolphin X claims compatibility with more than 300 applications, explicitly mentioning nine Chromium and Gecko browser families, over 100 cryptocurrency wallet extensions, 65 desktop wallets, 10 password managers, and more than 30 CLI tools commonly used in cloud environments.
Among the declared targets are .env files, SSH keys, cloud access tokens, browser sessions and credentials, plus information linked to cryptocurrency wallets. The existence of the AI Profiler workflow has been verified inside the panel along with internal strings and functions related to data collection and score calculation.
However, the actual AI engine responsible for generating the valuations has not yet been confirmed. Full analysis of an active sample running on a victim machine is still needed to determine which model is used, whether external services are called, or whether the system relies on rules and weightings given an attention-grabbing name.
No active distribution campaign or specific lures have been confirmed either. This gap does not reduce the risk. The combination of secret theft and automatic prioritization can drastically shorten the time until the next stage, such as account takeover, repository access, movement into production environments, or abuse of cloud infrastructure.
Related articles
Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from F6 identified a previously unknown cybercrime cluster named Malinsure that has been active since at least July 2026. The group distributes phishing emails containing PDF lures themed around voluntary medical insurance (DMS) discounts and updates from Russian insurance companies. Victims are tricked into downloading RAR or ZIP archives that abuse legitimate Microsoft binaries such as winword.exe and powerpnt.exe through DLL side-loading to execute the custom SafeMostSSH backdoor. The malware establishes a persistent reverse SSH tunnel to attacker-controlled servers and retrieves fresh C2 addresses from public posts on vc.ru by decoding fake PNG links. Additional delivery vectors include HTML and SHTML files that decode and drop archives containing the same payload components. Targets appear to include insurance, finance, and fuel-energy sector organizations, with infrastructure also referencing gosuslugi.email and minfin.support domains.
Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts
Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.
Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders
Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.