A financially motivated cybercrime group, CL-CRI-1089, is conducting Operation FlutterBridge, deploying the FlutterShell backdoor on macOS via malvertising. FlutterShell masquerades as legitimate apps such as podcast players and PDF viewers, delivering adware with backdoor features like shell command execution and file system access. The malware leverages a WebView-based architecture with a JavaScript-to-native bridge, allowing attackers to modify its behavior dynamically without recompilation. Distribution is through hundreds of Google-verified ads managed by shell companies (AdsParkPro LTD, Advantage Web Marketing LLC). All malware samples are signed with valid Apple Developer IDs and notarized, initially evading detection on VirusTotal. The malware also hijacks Google Chrome browsers to redirect user traffic. The campaign targets primarily Anglophone and Western European users. There is no known exploit in the wild beyond this campaign, and no patch or official remediation is documented.

The malware provides attackers with full backdoor capabilities on infected macOS systems, including executing shell commands and manipulating the file system. It also hijacks Google Chrome browser traffic, potentially enabling further malicious activities such as redirecting users to phishing or malicious sites. The use of valid Apple Developer IDs and notarization allows the malware to bypass typical macOS security controls and evade detection by antivirus solutions initially. This can lead to unauthorized access, data compromise, and persistent system control by the threat actors.

No official patch or remediation guidance is currently available for this threat. Since the malware relies on social engineering via malvertising and signed applications, users and organizations should exercise caution when installing new software, especially from unverified sources. Monitoring for suspicious domains and hashes associated with this campaign can aid detection. Due to the lack of an official fix, organizations should follow vendor advisories if they become available and consider blocking or filtering traffic from identified malicious domains. Regularly updating macOS and security software remains a best practice but may not fully prevent this threat due to its notarized nature.