Loading malware…
FlutterShell is a macOS malware family built with Google’s Flutter framework and best characterized as a backdoor with adware-style browser hijacking functionality. It has been associated with the financially motivated Operation FlutterBridge activity cluster, tracked as CL-CRI-1089, which evolved from earlier malvertising operations targeting both Windows and macOS users. Observed FlutterShell variants masqueraded as legitimate productivity applications such as podcast players and PDF utilities and were distributed to Mac users through large-scale malvertising, including malicious Google and YouTube advertisements that redirected victims to fake download sites. Samples were observed signed with valid Apple Developer IDs in earlier stages, helping them pass Gatekeeper and notarization checks before certificate revocation and later shifts to self-signed artifacts.
Architecturally, FlutterShell uses a thin launcher together with a larger Flutter/Dart payload and relies on a hidden WebView-based design to retrieve attacker-hosted JavaScript at runtime through a JavaScript-to-native bridge. This allows operators to keep substantial malicious logic off the binary and dynamically alter behavior server-side without redistributing the application. Across observed generations, the malware changed bridge command names and increased code obfuscation, including Dart symbol obfuscation, while preserving the same overall execution model.
Documented capabilities include arbitrary shell command execution, file system interaction, environment variable collection, hardware fingerprinting, and browser manipulation. A prominent monetization behavior is hijacking Google Chrome by modifying browser preferences so searches and new tabs are redirected through attacker-controlled advertising pages. FlutterShell has also been observed terminating and relaunching Chrome to enforce those changes while suppressing visible warnings. Some variants included a fake AI document summarization feature that transmitted user-supplied documents to attacker-controlled infrastructure before returning expected output, indicating an additional exfiltration path. Persistence has been linked to abuse of the Sparkle update mechanism and LaunchAgent-style installation behavior. The family is notable for conditional activation tied to live command infrastructure, which can reduce observable behavior in sandbox environments and complicate static detection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cluster: CL-CRI-1089 Campaign: Operation FlutterBridge Malware Family: FlutterShell (OSX/FlutterShell.A/B) Platform: macOS · x86_64 · arm64 Motivation: Financial, browser search hijack
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The campaign, tracked under the name Operation FlutterBridge and the cluster identifier CL-CRI-1089, spread through malicious Google and YouTube advertisements. The ads targeted users searching for terms like “podcast app for Mac” or “free PDF converter,” redirecting them to fake sites hosting digitally signed app bundles.
Threat actors are using Google Ads to push fake desktop applications that secretly install a powerful backdoor on infected machines.
Attack Chain 1 T1566/T1185 Initial Access, Malvertising [Assessed] Google/YouTube ad placement targeting keywords such as "podcast app for Mac" and "free PDF converter." Shell company ad accounts procured per generation. User clicks ad; redirected to typosquatted distribution domain; downloads a signed app bundle.
Researchers noted that FlutterShell has three main capabilities: arbitrary command execution, file system interaction, and environment variable exfiltration. It can run deep system commands and steal files.
MITRE ATT&CK Mapping Technique Tactic FlutterShell Behavior Basis T1059.004 Unix Shell Execution exec_sync/pdf_sync/renderPDF bridge commands Assessed
FlutterShell targets a Google Chrome settings file called Secure Preferences. It forces every new tab or search through an ad-filled website called sinterfumesco.com.
6 T1176 Impact, Chrome Search Hijack [Assessed] Modifies ~/Library/Application Support/Google/Chrome/Secure Preferences to inject sinterfumesco[.]com as default search provider. Kills Chrome; relaunches with --hide-crash-restore-bubble --disable-session-crashed-bubble to suppress browser warnings.
4 Dart symbol obfuscation Full obfuscation in Gen 3: all internal class names randomized; 707 obfuscated symbols confirmed Observed, symbol count from binary string extraction
A newly analyzed macOS backdoor called FlutterShell has been quietly targeting Mac users by disguising itself as legitimate productivity apps. It abuses Google’s Flutter app development framework to blend in with real software... the launcher looks nearly identical to any legitimate Flutter application.
What makes FlutterShell especially difficult to catch in automated sandboxes is its C2-conditional design. The malware only activates when it receives live instructions from an attacker-controlled server. In every sandbox test, the binary launched cleanly... and then produced no activity at all.
FlutterShell targets a Google Chrome settings file called Secure Preferences. It forces every new tab or search through an ad-filled website called sinterfumesco.com.
FlutterShell primarily serves as adware... but also contains backdoor functionality enabling arbitrary command execution, file manipulation and extraction of environment variables.
Once connected to a live server, FlutterShell is assessed to perform hardware fingerprinting by running a system command that harvests the Mac’s unique hardware identifier.
Researchers noted that FlutterShell has three main capabilities: arbitrary command execution, file system interaction, and environment variable exfiltration. It can run deep system commands and steal files.
What makes FlutterShell especially difficult to catch in automated sandboxes is its C2-conditional design. The malware only activates when it receives live instructions from an attacker-controlled server. In every sandbox test, the binary launched cleanly... and then produced no activity at all.
This allows the applications to facilitate malicious actions directed by the attacker controlled command-and-control (C2) domain without including malicious functions directly in the applications’ code.
The malware only activates when it receives live instructions from an attacker-controlled server... the malware opens a hidden WKWebView window and loads a page from an attacker-controlled domain. That page then delivers JavaScript to the app, which passes commands through a named message channel called flutterInvoke.
The application registers a named JavaScript message channel ( flutterInvoke ) within a WKWebView. The C2 server delivers JavaScript templates, confirmed via binary string extraction, which allows commands to be updated server-side without binary modification.
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS backdoor built with Flutter that uses WebView to load malicious JavaScript and exposes bridge functions enabling attackers to execute arbitrary payloads on the victim device.
A macOS backdoor that disguises itself as legitimate Flutter-based productivity apps, uses a stub launcher plus a Dart payload library, receives live commands via a hidden WKWebView from attacker-controlled servers, performs hardware fingerprinting, hijacks Chrome search settings, and establishes persistence via the Sparkle update mechanism.
macOS malware delivered via Flutter that separates the static binary from the command payload by loading attacker-controlled web content in a WKWebView at runtime. JavaScript from the C2 communicates with a native Dart handler through the flutterInvoke bridge, enabling C2-conditional execution, hardware fingerprinting, Chrome preference hijacking, Sparkle-based persistence, and runtime command delivery.
Mac malware used in the Operation FlutterBridge malvertising campaign. It masquerades as legitimate apps, loads malicious code from the internet, hijacks Chrome by modifying Secure Preferences and redirecting searches/new tabs, kills and restarts Chrome with hidden settings, and provides backdoor capabilities including arbitrary command execution, file system interaction, environment variable exfiltration, and document theft via a fake AI summarization feature.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.