Dolphin X Malware Adds AI Profiler to Rank and Prioritize High-Value Victims After Infection
Dolphin X is a new infostealer and RAT for Windows that incorporates an AI Profiler capable of scoring infected machines and ordering victims by value. The idea is to accelerate the transition from mass secret theft to subsequent compromises in accounts, cloud services, and production environments.
The novelty of Dolphin X lies not only in what it steals but in whom it decides to target first. This Windows malware, presented as both an infostealer and remote access trojan, includes a component called AI Profiler that classifies compromised machines, assigns scores, and builds a ranking so operators can concentrate time and resources on the most profitable victims.
The profiling relies on telemetry from the infected machine. This includes signals such as application usage, browser-visited domains, and installed software. From this data the attacker panel generates daily summaries and a priority order that reduces the manual triage work typically required after infection waves.
Operators first examine machines offering the greatest potential return, whether through cloud access, technical profiles, or the presence of sensitive tools. The operator panel showcases the product scope with 329 functions spread across 10 categories, a figure typical of commercial malware families that advertise extensive catalogs even before real-world campaigns are observed.
In the credential theft section, Dolphin X claims compatibility with more than 300 applications, explicitly mentioning nine Chromium and Gecko browser families, over 100 cryptocurrency wallet extensions, 65 desktop wallets, 10 password managers, and more than 30 CLI tools commonly used in cloud environments.
Among the declared targets are .env files, SSH keys, cloud access tokens, browser sessions and credentials, plus information linked to cryptocurrency wallets. The existence of the AI Profiler workflow has been verified inside the panel along with internal strings and functions related to data collection and score calculation.
However, the actual AI engine responsible for generating the valuations has not yet been confirmed. Full analysis of an active sample running on a victim machine is still needed to determine which model is used, whether external services are called, or whether the system relies on rules and weightings given an attention-grabbing name.
No active distribution campaign or specific lures have been confirmed either. This gap does not reduce the risk. The combination of secret theft and automatic prioritization can drastically shorten the time until the next stage, such as account takeover, repository access, movement into production environments, or abuse of cloud infrastructure.
Related articles
YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
The article presents a detailed translation and adaptation of Florian Roth's YARA Style Guide, aimed at bringing consistency to large collections of YARA rules used by security teams. It explains how to construct informative rule names that include threat category, context, operating system, architecture, technology, packers and creation date, using prefixes such as MAL, HKTL, WEBSHELL, EXPL, VULN, SUSP and PUA. The guide recommends specific metadata fields including description, author, date, reference, score and hash, along with a three-tier string categorization system using $x*, $s* and $a* prefixes for high-specificity, group and preliminary strings. It also covers false-positive filters marked with $fp*, proper indentation, readable hex and string formatting, and a recommended order of conditions that begins with header checks and ends with false-positive filters. The publication highlights the benefits of this structured approach for long-term maintainability and faster triage during mass detections. Additional references point to the separate YARA-Performance-Guidelines project for deeper optimization techniques.
187,064 Instructions for One Flag: Reverse Engineering HTB Callfuscated Insane Challenge
A detailed technical breakdown of the HackTheBox Callfuscated reversing challenge reveals an extremely heavy obfuscation scheme built around a custom virtual machine, mixed Boolean-arithmetic transformations, opaque predicates, and call-based junk code. The binary implements a password checker that executes 187,064 instructions even on a short input because every real operation is wrapped inside thousands of call/pop gadgets. The author bypassed static analysis by building a ptrace-based tracer, dumping the 586-cell VM program array, and writing a Python emulator that faithfully replays the recorded execution trace. After fixing several edge cases involving rand() return addresses and operand-size detection, the emulator reproduced the exact register state of the original binary. Dynamic analysis exposed that the VM performs simple big-endian word construction followed by XOR operations with eight constant pairs, allowing the flag to be recovered directly without further symbolic execution.
HollowGraph Malware Abuses Microsoft 365 Calendars to Conceal Stolen Files and C2 Traffic
A newly discovered espionage malware called HollowGraph turns compromised Microsoft 365 calendars into hidden channels for receiving commands and exfiltrating stolen data. The implant schedules events for 13 May 2050, a distant future date chosen to reduce the likelihood of discovery by account owners. Developed as a Windows DLL, HollowGraph leverages the Microsoft Graph API to blend its traffic with legitimate corporate service activity, eliminating the need to contact attacker-controlled servers directly. It supports two primary commands: “get” to retrieve instructions attached to operator-created appointments and “send” to encrypt collected data with RSA and AES-256-GCM before uploading it as calendar attachments. Separate encryption keys are used for inbound commands and outbound data, while stolen files are written to a disguised logAzure.txt file. Researchers have identified at least 12 compromised systems, three of which remained active, with operations observed between 3 June and 9 July 2026 and primarily targeting Israeli entities.
ClickLock Stealer Locks macOS Until Victims Enter Real Passwords and Exfiltrates Browser, Crypto and Keychain Data
Researchers at Group-IB have discovered a new macOS infostealer called ClickLock that blocks normal computer operation until the user supplies valid account credentials. The campaign, active since May 2026, has already affected at least 100 victims across 33 countries. Infection begins with a fake Cloudflare verification page that tricks users into pasting a command into Terminal, after which the malware silently downloads four modules from compromised WordPress sites. A convincing macOS password prompt then appears; ClickLock validates the entered password locally and only forwards working credentials to the operators. Two persistent LaunchAgent modules repeatedly close all visible applications and force Keychain authorization, while a separate process disables Notification Center for several hours. The malware harvests data from eight browsers, 31 crypto-wallet extensions, seven password managers, eight desktop wallets, Keychain items, command history, FTP credentials and six blockchain addresses before exfiltrating everything via Telegram bots and hijacked domains, leaving behind a disguised GSocket backdoor.