MalwareUsed by 1 actor

Calendaromatic

Calendaromatic is a Windows malware strain tracked as a backdoor that masquerades as a legitimate calendar download. It has been distributed via malvertising and SEO poisoning, including fake software download lures. Reporting links Calendaromatic to the CL-CRI-1089 cybercrime cluster and to the broader TamperedChef, also known as EvilAI, campaign set. Within that activity, trojanized productivity-themed software has been used to deliver potentially unwanted programs and adware, and infrastructure analysis linked Calendaromatic with the related Windows malware strain RecipeLister and later macOS-focused activity such as FlutterShell. High-confidence reporting specifically describes Calendaromatic as spread through malvertisements, appearing in MS-ISAC tracking as using the malvertisement infection vector in Q4 2025, and being associated with the TamperedChef malvertising campaign.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

CL-CRI-1089

This group previously used malvertising to target Windows users with fake programs called RecipeLister and Calendaromatic.

via hackreadhackread.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence5

Unit 42 reported a large-scale malvertising scam running since late 2025. In this scam, called Operation FlutterBridge, cybercriminals are using fake Google search ads to lure Mac owners into downloading malware.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

However, TamperedChef-style programs execute commands remotely, exfiltrate users' credentials and deploy malware without consent.

T1204.002Malicious FileEvidence1

TamperedChef (aka EvilAI), an ongoing series of campaigns that involve using trojanized versions of productivity software to deliver potentially unwanted programs (PUPs) and adware.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

Most of the campaigns we observed used some form of obfuscation or defense evasion techniques for their loader or stealer components.

T1036MasqueradingEvidence2

TamperedChef-style malware is trojanized productivity software, such as PDF editors or calendars, that deliver malicious payloads.

Defense Impairment

1 technique

T1553.002Code SigningEvidence2

One unique attribute of the TamperedChef-style malware is that almost all the first-stage binaries are signed with legitimate code-signing certificates. Attackers used code-signing to add stealth to these payloads.

Collection

1 technique

T1185Browser Session HijackingEvidence1

Upon installation, FlutterShell fingerprints the machine... Next, the malware targets the Google Chrome “Secure Preferences” file... changing the url and new_tab_url values to the attacker-controlled domain.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence3

What makes FlutterShell noteworthy is that it implements a WebView-based architecture that utilizes a JavaScript-to-native bridge, thereby allowing the adversary to host malicious logic on an external website, rather than embedding it into the binary.

T1105Ingress Tool TransferEvidence2

Upon activation, they trigger the next stage, which typically involves downloading and executing an additional payload delivered via an upstream API.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app28 days ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

hackreadNews

Jun 8, 2026

Operation FlutterBridge Uses Fake Google Ads to Spread macOS Backdoor

A fake Windows program used in earlier malvertising activity by CL-CRI-1089 to target Windows users.

security online infoNews

Jun 8, 2026

Operation FlutterBridge Malware Attacks macOS Users

A Windows-based malware strain linked by shared infrastructure to the same umbrella crime organization as FlutterShell.

the hacker newsNews

Jun 4, 2026

FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads

A malware/application family associated with CL-CRI-1089 and the TamperedChef campaign, distributed through trojanized productivity software to deliver PUPs and adware. It shares technical similarities with FlutterShell, especially a WebView-based code architecture enabling dynamic payload changes.

palo alto networks unit 42 blogNews

Jun 2, 2026

Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor

A Windows malware strain in the CL-CRI-1089 cluster distributed via malvertising. It shares technical similarities with FlutterShell, including WebView-based architecture for dynamic payload changes, and performs browser hijacking via similarly structured ad-filled redirect sites.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Calendaromatic