Operation FlutterBridge Delivers macOS FlutterShell Backdoor Through Malvertising
Summary
Unit 42 reports that CL-CRI-1089 used hundreds of Google-verified ads and shell companies to distribute FlutterShell, a macOS backdoor disguised as apps. Its remote JavaScript bridge enables command execution, Chrome hijacking and document exfiltration through AI summar
Key points
- Researchers identified three FlutterShell variants disguised as a podcast player and PDF viewers; the apps were signed with valid Apple Developer IDs and passed notarization.
- A WebView-based JavaScript-to-native bridge loads malicious logic remotely, allowing attackers to change commands without rebuilding or redistributing the app.
- The backdoor can execute shell commands, manipulate files and collect environment variables; observed adware behavior includes changing Chrome settings to route traffic through an ad-filled intermediary.
- Some PDF-viewer variants send document contents through attacker infrastructure before AI summarization, allowing attackers to collect the documents.
- The campaign distributed the apps through hundreds of Google-verified ads and shell companies. After Unit 42 reported the advertisers, Google said it had suspended their accounts.
- Researchers found increasing obfuscation across variants and technical similarities to JSCoreRunner, including shared backdoor commands and a JavaScript-to-native architecture.
Article Details
- Attack Vectors
- Verified advertisements distributed through shell-company advertiser accounts promoted malicious macOS installers disguised as podcast players and PDF viewers.
- FlutterShell loads attacker-hosted webpages in a WebView and uses a JavaScript-to-native bridge to execute remotely supplied commands.
- The malware modifies Google Chrome preferences and relaunches the browser to route searches and new tabs through an ad-filled intermediary site.
- Some variants route document contents through attacker infrastructure for AI summarization, allowing the operators to collect the contents.
- The malware delays loading its malicious webpage after startup; user clicks on application About or Update buttons can also trigger the webpage.
- Defensive Notes
- Google stated that it suspended advertiser accounts for violating its policies after the campaign was reported.
- The article says URL and DNS filtering identify known domains and URLs associated with the activity, and endpoint prevention layers can help prevent the malware.
- The article reports that malware-analysis protections were reviewed and updated using indicators associated with FlutterShell.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ads-parkpro[.]com | Website previously associated with AdsParkPro LTD, a shell advertiser linked to the campaign's malicious advertising activity. |
| DOMAIN | adsparkpro[.]net | Listed as prior infrastructure linked to shell entities used in the campaign's malicious advertising. |
| DOMAIN | adsparkpro[.]top | Listed as prior infrastructure linked to shell entities used in the campaign's malicious advertising. |
| DOMAIN | atsheisdomestic[.]org | PodcastsLounge C2 domain hosting malicious web content and update logic. |
| DOMAIN | etoftheappyrince[.]org | PDF-Brain C2 domain used to host attacker-controlled content and update endpoints. |
| DOMAIN | healightejustb[.]org | PDF-Ninja C2 domain hosting attacker-controlled content and update endpoints. |
| DOMAIN | sinterfumesco[.]com | Attacker-controlled adware intermediary set in Chrome preferences to receive hijacked searches and new-tab traffic. |
| DOMAIN | softwe[.]art | Website associated with SOFT WE ART, an entity linked to prior malicious adware distribution. |
| SHA256 | 021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b845 | SHA-256 of the malicious PodcastsLounge DMG installer. |
| SHA256 | 30448686ec900d5213d74f08f0d2b7924c5336a29445b2a434aba8d8b19d7530 | SHA-256 of the malicious PDF-Ninja application executable. |
| SHA256 | 363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc34 | SHA-256 of the malicious PodcastsLounge application executable. |
| SHA256 | 48047c34bbd57fe1e24bc538bc2ce9e0ac4c4eb48d3b0c195b414f0379dc0745 | SHA-256 of a dynamic library associated with the malicious PDF-Ninja application. |
| SHA256 | 644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e70 | SHA-256 of the malicious PDF-Brain DMG installer. |
| SHA256 | 8421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b2533109 | SHA-256 of a dynamic library associated with the malicious PodcastsLounge application. |
| SHA256 | 9053e8ddaecca1f960c041c944ca8799fc71dc86a4b50d2639ee4e0d2cb82f47 | SHA-256 of the malicious PDF-Brain application executable. |
| SHA256 | 9425e8e39fa8a7212cdd07f0917cb3dfde38a90b87297de2c82a5850aff1e4de | SHA-256 of the malicious PDF-Ninja DMG installer. |
| SHA256 | b60074d1ea2008a581f432f2dee5f84f78668d9dd8e66f75d03c42dabd89bdea | SHA-256 of a dynamic library associated with the malicious PDF-Brain application. |
| URL | hxxps[:]//atsheisdomestic[.]org/update-thanks.html | Attacker-controlled PodcastsLounge webpage containing the malicious FlutterShell logic. |
| URL | hxxps[:]//etoftheappyrince[.]org/update-delay | PDF-Brain C2 update-delay endpoint. |
| URL | hxxps[:]//healightejustb[.]org/checkupdateTO.js | PDF-Ninja C2 JavaScript endpoint. |
MITRE ATT&CK
T1005 · Data from Local SystemThe backdoor can read files, including documents processed by its summarization feature, before forwarding their contents.T1027 · Obfuscated Files or InformationThe PDF-Brain variant obfuscates strings, and PDF-Ninja uses Flutter's obfuscation flag to strip debug information and randomize symbols.T1036.005 · Match Legitimate Resource Name or LocationFlutterShell variants masquerade as legitimate podcast-player and PDF-viewer applications.T1041 · Exfiltration Over C2 ChannelSome variants forward document contents through the attackers' C2 server for AI summarization, enabling exfiltration.T1059.004 · Unix ShellFlutterShell's built-in commands can execute arbitrary shell commands on the infected macOS system.T1059.007 · JavaScriptFlutterShell executes attacker-supplied JavaScript loaded in its WebView through a JavaScript-to-native bridge.T1071.001 · Web ProtocolsFlutterShell uses HTTP requests and attacker-hosted webpages to communicate with its C2 infrastructure.T1105 · Ingress Tool TransferFlutterShell retrieves remote JavaScript logic and update-related content from attacker-controlled endpoints.T1204.002 · Malicious FileThe campaign distributes malicious application installers disguised as desktop software; loading malicious content can also follow user clicks on About or Update buttons.T1497.003 · Time Based ChecksFlutterShell delays loading attacker-controlled content after startup, including fallback delays of 600 or 1200 seconds, to evade short-running analysis environments.T1565.001 · Stored Data ManipulationFlutterShell alters Chrome Secure Preferences, changing search and new-tab URLs to route browser traffic through attacker infrastructure.
Threat Actors
Malware
CalendaromaticOperations attributed to this cluster include the RecipeLister and Calendaromatic Windows campaigns, as well as the JSCoreRunner macOS campaign.FlutterShellOperation FlutterBridge is a widespread macOS malvertising campaign tied to CL-CRI-1089 that delivers FlutterShell, a Flutter-based backdoor masquerading as legitimate apps while also enabling adware and dataJSCoreRunner#FlutterShellRecipeListerOperations attributed to this cluster include the RecipeLister and Calendaromatic Windows campaigns, as well as the JSCoreRunner macOS campaign.
Vendors
AppleAll observed samples were signed with valid Apple Developer IDs and successfully passed notarization, meaning Apple’s automated security checks did not flag them as malicious at the time of submission. Figure 2 showsGoogleThe campaign uses verified Google Ads and shell companies to distribute rapidly evolving variants that hijack Google Chrome, execute shell commands, and in some cases forward documents through attacker infrastructure
Products
Google Chromeuses verified Google Ads and shell companies to distribute rapidly evolving variants that hijack Google Chrome, execute shell commands, and in some cases forward documents through attacker infrastructure for AImacOSOperation FlutterBridge is a widespread macOS malvertising campaign tied to CL-CRI-1089 that delivers FlutterShell, a Flutter-based backdoor masquerading as legitimate apps while also enabling adware and data
Tools
AgentiX Agentic AssistantCortex’s AgentiX Agentic Assistant streamlined the investigation by allowing the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations on what shouldBlutterTo overcome these challenges, we used a custom version of Worawit Wangwarunyoo’s blutter tool to disassemble the Dart binary and reconstruct the application logic.
Countries
Australiamarkets (notably France and Germany) and English-speaking regions, including the U.S., Canada and Australia. We identified multiple infected hosts targeted by this threat from correlating regions.CanadaWestern European markets (notably France and Germany) and English-speaking regions, including the U.S., Canada and Australia. We identified multiple infected hosts targeted by this threat from correlating regions.Franceclusters where the actor focused their budget. These included Western European markets (notably France and Germany) and English-speaking regions, including the U.S., Canada and Australia. We identifiedGermanywhere the actor focused their budget. These included Western European markets (notably France and Germany) and English-speaking regions, including the U.S., Canada and Australia. We identified multiple infectedUkraineAt first glance, these companies appeared to be legitimate Ukraine and UK-based enterprises, registered years before the malicious activity ever started.United KingdomAt first glance, these companies appeared to be legitimate Ukraine and UK-based enterprises, registered years before the malicious activity ever started.United Statesincluded Western European markets (notably France and Germany) and English-speaking regions, including the U.S., Canada and Australia. We identified multiple infected hosts targeted by this threat from correlating