Dolphin X & Phantom Stealer v3.5: AI-Driven & Multi-Stage Infostealer Campaigns — Enterprise Detection Pack | Security Arsenal

Recent OTX pulses reveal two concurrent infostealer campaigns actively targeting enterprise credentials and cloud infrastructure.

The first campaign features Dolphin X, a new Windows stealer attributed to the actor Kontraknik. This malware is highly aggressive, targeting over 300 applications, including password managers, cryptocurrency wallets, and critical DevOps tools (SSH keys, .env files, cloud tokens). A standout capability is its AI Profiler, which automatically scores infected victims based on their value, likely dictating the priority of follow-on exploitation or data monetization.

The second campaign utilizes Phantom Stealer v3.5.0, delivered via sophisticated phishing emails impersonating legitimate entities like UPS and the Malaysian Inland Revenue Board. Targeting the Finance and Government sectors in Malaysia, this campaign employs a multi-stage attack chain: compressed archives containing malicious JavaScript files that launch obfuscated PowerShell scripts using reflective loading to stay memory-resident and evade detection.

Both campaigns prioritize credential theft and exfiltration, posing significant risks to identity management and cloud security architectures.

Threat Actor / Malware Profile

Dolphin X (Kontraknik)

Type: Windows Infostealer / RAT
Distribution: Unknown (likely phishing or cracked software)
Capabilities: Harvests credentials from browsers, emails, and crypto wallets. specifically targets DevOps credentials (SSH keys, cloud tokens).
Unique Feature: "AI Profiler" for victim valuation.
C2: Communicates with thedolphinx.top infrastructure over HTTP (Port 8443).

Phantom Stealer v3.5.0

Type: Infostealer
Distribution: Phishing (Business Email Compromise style impersonating logistics/tax entities).
Payload: JavaScript -> Obfuscated PowerShell -> Reflective DLL Loading.
TTPs: Fileless execution (in-memory), SMTP exfiltration, Process Injection.
Targets: Finance and Government entities in Malaysia.

IOC Analysis

The provided Indicators of Compromise (IOCs) allow for precise detection and blocking:

Domains & URLs: thedolphinx.top and http://backend.thedolphinx.top:8443 are the Command and Control (C2) servers for Dolphin X. These should be blocked immediately at the perimeter and proxy level.
File Hashes: A mix of MD5, SHA1, and SHA256 hashes are provided. These correspond to the malicious payloads (JavaScript droppers and executables) for Phantom Stealer and the Dolphin X binary. These hashes must be uploaded to EDR detection rules and SIEM correlation engines.
Operationalization: SOC teams should prioritize the SHA256 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 (Dolphin X) and the set of MD5 hashes associated with the Phantom Stealer JavaScript droppers.

Detection Engineering

YAML

---
title: Phantom Stealer JS to PowerShell Execution
id: 2a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects Phantom Stealer execution pattern where JavaScript files launch obfuscated PowerShell scripts.
status: experimental
author: Security Arsenal
date: 2026/07/23
references:
    - https://www.seqrite.com/blog/abusing-trusted-business-workflows-a-multi-stage-phantom-stealer-campaign/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-EncodedCommand'
            - '-Enc'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
tags:
    - attack.execution
    - attack.t1059.001
---
title: Dolphin X Stealer C2 Communication
id: 3b0c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects network connections to the known Dolphin X Stealer C2 infrastructure.
status: experimental
author: Security Arsenal
date: 2026/07/23
references:
    - https://www.varonis.com/blog/dolphin-x-stealer
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains: 'thedolphinx.top'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Sensitive File Access by Uncommon Process
id: 4c1d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
description: Detects access to sensitive credential files (.env, SSH keys) potentially by stealers like Dolphin X.
status: experimental
author: Security Arsenal
date: 2026/07/23
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\.env'
            - '\.ssh\'
            - '\wallets\'
        Image|contains:
            - '\Temp\'
            - '\Users\Public\'
            - '\AppData\Roaming\'
    condition: selection
falsepositives:
    - Development tools
level: medium
tags:
    - attack.collection
    - attack.t1005

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for Phantom Stealer Hashes and Process Chain
DeviceProcessEvents
| where SHA256 in ("64a68e4e1b93f1347c0935875395672784db5b49027c6508f13983efa98971f8", "726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0") or MD5 in ("34bfa888695b9aaa41bd575245972043", "5f238710a5ef4f6ddbbe7a118c822705", "6bbfc88534d5d515dddb0ec9bb618530", "8a620e451e64f418bc21fd458e952f2e", "a30b628d0c087f305b35be3e3f5281b3")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FolderPath, SHA256, MD5
| union (DeviceNetworkEvents | where RemoteUrl contains "thedolphinx.top")

PowerShell Hunt Script

PowerShell

# IOC Hunt for Dolphin X and Phantom Stealer
$MaliciousHashes = @(
    "726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0",
    "64a68e4e1b93f1347c0935875395672784db5b49027c6508f13983efa98971f8",
    "34bfa888695b9aaa41bd575245972043",
    "5f238710a5ef4f6ddbbe7a118c822705",
    "6bbfc88534d5d515dddb0ec9bb618530",
    "8a620e451e64f418bc21fd458e952f2e",
    "a30b628d0c087f305b35be3e3f5281b3"
)

Write-Host "Scanning for malicious file hashes in common user directories..."
Get-ChildItem -Path "C:\Users\" -Recurse -ErrorAction SilentlyContinue | Where-Object {
    $_.Length -lt 50MB 
} | ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($hash -in $MaliciousHashes) {
        Write-Host "[ALERT] Malicious file found: $($_.FullName) | Hash: $hash" -ForegroundColor Red
    }
}

Write-Host "Checking DNS Cache for Dolphin X C2 domains..."
$Domains = @("thedolphinx.top", "backend.thedolphinx.top")
Get-DnsClientCache | Where-Object { $Domains -contains $_.Entry } | ForEach-Object {
    Write-Host "[ALERT] C2 Domain found in DNS Cache: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
}

Response Priorities

Immediate:
- Block all communication with thedolphinx.top and backend.thedolphinx.top at firewalls and proxies.
- Scan all endpoints for the provided file hashes (MD5, SHA1, SHA256).
- Isolate any systems with positive hits.
24 Hours:
- If infection is confirmed, force a password reset for all credentials stored on affected machines, prioritizing SSH keys, cloud tokens, and crypto wallets.
- Review logs for evidence of data exfiltration (SMTP logs for Phantom Stealer; HTTP POST logs to Dolphin X C2).
1 Week:
- Implement application whitelisting (e.g., AppLocker) to prevent unsigned JavaScript and obfuscated PowerShell execution in user directories.
- Conduct user awareness training specifically focusing on phishing scams impersonating tax authorities and logistics firms.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Dolphin X & Phantom Stealer v3.5: AI-Driven & Multi-Stage Infostealer Campaigns — Enterprise Detection Pack