Operation Flutter Bridge: macOS Malvertising Campaign Spreads New Flutter Shell Backdoor
Summary: Unit 42 is tracking Operation FlutterBridge, a macOS malvertising campaign that evolved from the JSCoreRunner campaign first identified in August 2025 and delivers a new Flutter-built backdoor called FlutterShell through hundreds of Google-verified ads distributed via shell companies. Three variants appeared roughly one month apart, posing as a podcast app (PodcastsLounge) and two PDF viewers (PDF-Brain and PDF-Ninja), all signed with valid Apple Developer IDs, successfully notarized, and showing zero detections on VirusTotal at the time of analysis.
What you should know: The payloads passed Apple notarization and had zero VirusTotal detections, and the PDF-Brain and PDF-Ninja variants route every document through an attacker-controlled /summarize-text endpoint before forwarding it to an AI agent, so the user gets a summary while the attackers harvest the full contents.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026