Dolphin X and Forg365: AI Is Now Standard Issue in Attacker Toolkits

Two research disclosures this month put the same message in different fonts. Varonis Threat Labs found a commodity remote access trojan advertising an AI behavioral profiler that scores infected victims. ZeroBEC found a phishing-as-a-service platform with AI-generated lure generation baked in. Neither is a sophisticated nation-state tool. Both are sold to criminal operators. The AI features are there because they work.

Dolphin X: A RAT With a Scorecard

Varonis Threat Labs researcher Daniel Kelley spotted Dolphin X on a cybercrime forum in July 2026. The vendor, operating under the name Kontraktnik, advertised it as an all-in-one platform with 329 features across ten categories. The feature list reads like a credential theft encyclopedia. Dolphin X targets over 300 applications including browsers, cryptocurrency wallets, password managers, cloud storage clients, SSH key stores, and .env files. Developer credentials in particular are a stated priority.

The AI profiler is the unusual part. Dolphin X analyzes behavioral data from infected machines, including which applications the victim uses and how often, then produces a risk score and a daily summary for the operator. The profiler is described in developer documentation as an “AI behavioral profiler with app usage tracking, risk score, and daily summary.”

Varonis confirmed three strings in the codebase: risk_score, ProfilerStart, and ProfilerGetData. The team analyzed the operator panel and builder in an isolated lab environment rather than running live samples, which means the specific AI engine behind the scoring could not be determined. What is clear is the business logic. A campaign that drops Dolphin X on thousands of machines ends up with a prioritized inbox rather than a raw dump. The operator focuses on targets that matter.

This changes the economics of mass infection. Conventional stealers dump everything to an operator panel. Reviewing thousands of logs to find a CFO’s credentials or an administrator’s SSH keys takes time. Dolphin X automates that triage. The AI layer doesn’t improve the malware’s ability to compromise machines. It improves the attacker’s ability to process what they’ve already stolen.

Forg365: Phishing-as-a-Service With an AI Lure Factory

ZeroBEC, an email security company, published research in early July 2026 on Forg365, a phishing-as-a-service platform purpose-built for Microsoft 365 account theft. Subscribers get a campaign dashboard, a link manager, AI-generated phishing email drafts, and post-compromise access tooling.

The attack vectors are recognizable but the infrastructure is not casual. Forg365 supports two primary methods. Device-code phishing exploits the OAuth 2.0 device authorization flow, which lets devices without browsers authenticate to cloud services. An attacker initiates a legitimate device code request, then instructs the victim to enter the resulting code at a real Microsoft sign-in page. The victim authenticates against Microsoft directly. The attacker’s session receives the resulting token. No fake page is involved in the authentication step. Microsoft’s own infrastructure completes it.

The second method is adversary-in-the-middle, proxying the victim’s real authentication session to capture tokens and session cookies in transit.

Post-compromise persistence runs through ForgCookie, a browser extension compatible with Chrome, Edge, and Brave. The extension silently triggers OAuth flows to keep Microsoft SSO cookies refreshed, maintaining access without requiring the victim to re-authenticate. The platform monitors compromised mailboxes for configurable keywords, letting operators target specific accounts for business email compromise or data collection without sifting through every inbox manually.

Infrastructure is designed to reduce attribution: Amazon SES for email delivery, Cloudflare Pages for landing pages, Gophish for campaign distribution. Anti-detection features include AES-encrypted redirectors, bot detection, debugger traps, sandbox checks, and polymorphic code generation.

The AI component sits in the lure generation layer. Forg365 generates customized phishing emails through an integrated AI function, reducing the per-target cost of producing convincing bait. What took a human writer an hour per target now takes seconds at campaign scale.

The Pattern Is the Point

Both tools use AI to solve the same underlying problem: scale. Credential theft campaigns hit many targets. Processing those targets used to require human time proportional to volume. Dolphin X applies that logic to post-infection triage. Forg365 applies it to pre-infection targeting. The manual labor that used to cap campaign throughput is being automated out of the equation.

The attack surfaces have not changed. Dolphin X arrives through standard malware delivery channels. Forg365 exploits authentication flows that have existed since Microsoft introduced device codes. Endpoint detection, phishing-resistant MFA, and OAuth monitoring remain the relevant defenses. The change is in how fast an operator can work once they have initial access, and how efficiently they can identify and act on what they find.

Security teams that benchmark their detection capabilities against the attacker’s technical skill are measuring the wrong thing. The question now is whether defenses can keep pace with attacker throughput, not attacker sophistication.

References

• BleepingComputer — New Dolphin X Malware Uses AI to Rank High-Value Targets
• BleepingComputer — New Forg365 Phishing Platform Uses AI to Target Microsoft 365 Accounts