Loading threat actor…
CL-CRI-1089 is a cybercrime activity cluster active since at least 2023 that operates large-scale malvertising campaigns distributing trojanized productivity and utility software across Windows and macOS environments. The cluster is associated with the macOS Operation FlutterBridge campaign and the FlutterShell malware family, and has also been linked to earlier macOS JSCoreRunner/FileRipple activity and Windows campaigns involving fake applications such as RecipeLister and Calendaromatic. Related campaign umbrellas and overlapping reporting include TamperedChef and EvilAI. The group commonly uses polished fake software brands, sponsored search results, and verified advertising accounts to lure victims into downloading functional-looking applications that conceal malicious behavior. Observed lures have included podcast players, PDF viewers, calendars, and other business-oriented tools. The operators have used shell companies and legitimate code-signing identities to improve trust, pass platform checks, and scale ad distribution. On macOS, FlutterShell represents a more advanced stage of the cluster’s tooling. It is a Flutter-based backdoor and browser-hijacking implant that uses a WebView plus a JavaScript-to-native bridge to retrieve attacker-controlled logic dynamically at runtime rather than embedding all functionality in the binary. This architecture supports rapid payload changes and complicates static analysis. Reported capabilities include system fingerprinting, arbitrary command execution, file-system interaction, environment-variable exfiltration, browser preference tampering, Chrome search and new-tab hijacking for ad-revenue generation, persistence via LaunchAgent mechanisms, and silent update or replacement behavior. Some variants also abused an apparent AI document summarization workflow to exfiltrate uploaded documents. Reporting also links the cluster to browser session theft and broader credential-focused activity in related campaigns. Across its wider operations, CL-CRI-1089 has delivered adware, browser hijackers, information stealers, remote-access trojans, and occasionally proxy-style payloads. The cluster is notable for delayed activation, staged payload delivery, extensive use of malvertising infrastructure, and repeated reuse of corporate structures tied to code signing and distribution. Available evidence supports a primarily financially motivated criminal operation focused on monetization through advertising fraud, browser hijacking, data theft, and follow-on payload delivery.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
46 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated macOS malware activity using the FlutterShell family in Operation FlutterBridge, with browser search hijacking, C2-conditional execution via WKWebView and a JavaScript bridge, certificate rotation, obfuscation, and persistence mechanisms such as LaunchAgents and Sparkle-based bundle replacement.
Cybercrime network behind Operation FlutterBridge, using malvertising and fake Google ads to lure users into downloading trojanized applications. The group shifted from Windows-focused fake apps to Apple/macOS campaigns and deployed FlutterShell as a backdoor capable of browser hijacking, command execution, file interaction, and data exfiltration.
Financially motivated activity cluster behind a widespread malvertising campaign targeting Apple desktop ecosystems, evolving from adware distribution to a backdoor-capable operation using signed macOS apps, browser hijacking, remote WebView-based logic, command execution, data exfiltration, and filesystem manipulation.
Threat cluster behind the Operation FlutterBridge malvertising campaign distributing FlutterShell via malicious Google Ads for macOS applications, with links to earlier JSCoreRunner activity and Windows attacks under the TamperedChef campaign umbrella.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.