Dolphin X RAT Uses AI to Score High-Value Targets

A new remote access trojan called Dolphin X includes a feature its authors market as AI-powered victim prioritization: a module that scores infected hosts and ranks them so the operator can target the most valuable victims first. BleepingComputer reported on it on July 23, 2026. The AI claims are the authors’ — not independently verified — but the scoring and ranking behavior is documented.

What changed

Victim triage after initial compromise is not new. Ransomware operators and fraud crews have been sorting victims by apparent value since the operation model existed. The claimed change here is automation: instead of a human analyst reviewing exfiltrated data to decide where to invest effort, the scoring runs on the host and feeds results back to the operator.

Whether the underlying feature uses anything meaningfully described as AI is secondary to the operational effect. Automated victim prioritization at scale means lower-overhead targeting — organizations that weren’t worth manual analysis start crossing the threshold when selection is automated.

What it means for defenders

The infection step is still the failure point. The scoring module runs post-compromise. If Dolphin X is on an endpoint, it already got in. The prioritization feature doesn’t change prevention posture — endpoint protection, phishing-resistant MFA, and behavioral detection for post-compromise activity are still the relevant controls.

Reduce what your endpoints broadcast. If a profiling module reads installed software, user roles, domain membership, or visible data sources to estimate victim value, those are signals you can constrain. Least-privilege discipline, keeping sensitive tooling off general-use devices, and limiting what a local process can enumerate all reduce a scoring module’s inputs.

The automation trend matters more than this specific RAT. AI-assisted victim selection lowers the cost of targeted attacks. That expands the viable target pool. If your risk model has included “we’re too small to be worth targeting,” it’s worth revisiting that assumption when targeting overhead drops.

Priority call

Dolphin X adds automation to a capability threat actors already had. The underlying defense is unchanged: prevent the initial compromise, detect it fast when it happens. Indicators and technical detail are in BleepingComputer’s full report.

Related: JadeProx TriBack Loader — China-nexus APT with a novel Windows loader and the threat intelligence hub.