Operation FlutterBridge: The FlutterShell macOS Backdoor

FlutterShell is a macOS backdoor campaign active from December 2025 to March 2026, identified as cluster CL-CRI-1089 under Operation FlutterBridge. The threat actors deliberately misused the Flutter framework to deliver malware through malvertising campaigns on Google and YouTube. The malware employs a two-component architecture: a thin Mach-O launcher and a large Flutter payload dylib. Across three generations, the operators rotated Apple Developer certificates, implemented progressive Dart obfuscation, and renamed bridge commands to evade detection. The backdoor uses a WKWebView to load attacker-controlled JavaScript from C2 servers, implementing a conditional execution model where commands are delivered at runtime via a JavaScript-to-native bridge called flutterInvoke. The primary impact includes Chrome browser hijacking to inject sinterfumesco[.]com as the default search provider and persistent infection through silent Sparkle framework updates.

• Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell BackdoorMalware2026-06-02
• RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser TheftMalware2026-09-24
• Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by SideMalware2026-08-13
• China-based hackers-for-hire group staging espionage attacks alongside a cryptocurrency fraud businessMalware2026-08-13
• 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic RedirectionCampaign2026-08-12