Flutter Shell Backdoor Spreads to macOS via Malicious Google and YouTube Ads
Summary: Palo Alto Networks Unit 42 attributed a macOS malvertising campaign called Operation FlutterBridge to a cybercrime group tracked as CL-CRI-1089, which spreads a new Flutter-built backdoor named FlutterShell through malicious Google and YouTube ads placed by Google-verified shell companies. FlutterShell supports arbitrary command execution, file system manipulation, and environment variable exfiltration, and all observed samples were signed with valid Apple Developer IDs and passed notarization.
What you should know: The malware runs its logic through a WebView JavaScript-to-native bridge hosted on an external site, so the operator can change behavior in real time without shipping a new binary - and Apple's notarization checks cleared every sample.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026