Loading malware…
FlutterShell is a Flutter-based macOS malware family and backdoor associated with Operation FlutterBridge and cluster CL-CRI-1089. It masquerades as legitimate productivity applications, including PodcastsLounge, PDF-Brain, and PDF-Ninja, and has been distributed through large-scale malvertising via malicious Google and YouTube ads that redirect users to fake download sites hosting digitally signed macOS app bundles. Reported activity spans late 2025 through March 2026 and targets macOS systems on both x86_64 and arm64 architectures.
The malware uses a two-component architecture consisting of a thin launcher and a larger Flutter/Dart payload library. It initializes a hidden WKWebView and retrieves attacker-controlled web content at runtime, using a JavaScript-to-native bridge via the message channel "flutterInvoke" to receive commands. Reported bridge command names changed across generations from "exec_sync" to "pdf_sync" to "renderPDF." This design allows operators to host malicious logic remotely and alter behavior without updating the installed binary, and sandbox analysis indicated execution was conditional on live C2 responses.
FlutterShell primarily functions as adware by modifying Google Chrome Secure Preferences to hijack the default search provider and new-tab behavior, redirecting traffic to the attacker-controlled domain sinterfumesco.com. It also kills and relaunches Chrome with arguments intended to suppress crash warnings. In addition to browser hijacking, reported backdoor capabilities include arbitrary shell command execution, file system manipulation, extraction of environment variables, hardware fingerprinting including collection of the Mac IOPlatformUUID, and data exfiltration. Some PDF-themed variants included an AI document summarization feature that uploaded victim documents to attacker-controlled servers before returning summary results.
Persistence has been reported through quiet replacement using the Sparkle update mechanism, with some reporting also noting LaunchAgent persistence. The operators rotated Apple Developer certificates and later used self-signed artifacts across multiple generations. Known associated infrastructure includes the domains atsheisdomestic.org, etoftheappyrince.org, healightejustb.org, and sinterfumesco.com. Reported bundle IDs include com.app.podcastsLounge, com.app.pdfBrain, and com.pdfninja.app, and reported Team IDs include UBZDAAV97Y, FW9NHQ8922, and B73CHZ24Y8. The campaign has been described as financially motivated, with monetization centered on browser search hijacking and ad traffic redirection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cluster: CL-CRI-1089 Campaign: Operation FlutterBridge Malware Family: FlutterShell (OSX/FlutterShell.A/B) Platform: macOS · x86_64 · arm64 Motivation: Financial, browser search hijack
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The campaign, tracked under the name Operation FlutterBridge and the cluster identifier CL-CRI-1089, spread through malicious Google and YouTube advertisements. The ads targeted users searching for terms like “podcast app for Mac” or “free PDF converter,” redirecting them to fake sites hosting digitally signed app bundles.
Threat actors are using Google Ads to push fake desktop applications that secretly install a powerful backdoor on infected machines.
Attack Chain 1 T1566/T1185 Initial Access, Malvertising [Assessed] Google/YouTube ad placement targeting keywords such as "podcast app for Mac" and "free PDF converter." Shell company ad accounts procured per generation. User clicks ad; redirected to typosquatted distribution domain; downloads a signed app bundle.
Researchers noted that FlutterShell has three main capabilities: arbitrary command execution, file system interaction, and environment variable exfiltration. It can run deep system commands and steal files.
MITRE ATT&CK Mapping Technique Tactic FlutterShell Behavior Basis T1059.004 Unix Shell Execution exec_sync/pdf_sync/renderPDF bridge commands Assessed
FlutterShell targets a Google Chrome settings file called Secure Preferences. It forces every new tab or search through an ad-filled website called sinterfumesco.com.
6 T1176 Impact, Chrome Search Hijack [Assessed] Modifies ~/Library/Application Support/Google/Chrome/Secure Preferences to inject sinterfumesco[.]com as default search provider. Kills Chrome; relaunches with --hide-crash-restore-bubble --disable-session-crashed-bubble to suppress browser warnings.
4 Dart symbol obfuscation Full obfuscation in Gen 3: all internal class names randomized; 707 obfuscated symbols confirmed Observed, symbol count from binary string extraction
A newly analyzed macOS backdoor called FlutterShell has been quietly targeting Mac users by disguising itself as legitimate productivity apps. It abuses Google’s Flutter app development framework to blend in with real software... the launcher looks nearly identical to any legitimate Flutter application.
What makes FlutterShell especially difficult to catch in automated sandboxes is its C2-conditional design. The malware only activates when it receives live instructions from an attacker-controlled server. In every sandbox test, the binary launched cleanly... and then produced no activity at all.
FlutterShell targets a Google Chrome settings file called Secure Preferences. It forces every new tab or search through an ad-filled website called sinterfumesco.com.
FlutterShell primarily serves as adware... but also contains backdoor functionality enabling arbitrary command execution, file manipulation and extraction of environment variables.
Once connected to a live server, FlutterShell is assessed to perform hardware fingerprinting by running a system command that harvests the Mac’s unique hardware identifier.
Researchers noted that FlutterShell has three main capabilities: arbitrary command execution, file system interaction, and environment variable exfiltration. It can run deep system commands and steal files.
What makes FlutterShell especially difficult to catch in automated sandboxes is its C2-conditional design. The malware only activates when it receives live instructions from an attacker-controlled server. In every sandbox test, the binary launched cleanly... and then produced no activity at all.
This allows the applications to facilitate malicious actions directed by the attacker controlled command-and-control (C2) domain without including malicious functions directly in the applications’ code.
The malware only activates when it receives live instructions from an attacker-controlled server... the malware opens a hidden WKWebView window and loads a page from an attacker-controlled domain. That page then delivers JavaScript to the app, which passes commands through a named message channel called flutterInvoke.
The application registers a named JavaScript message channel ( flutterInvoke ) within a WKWebView. The C2 server delivers JavaScript templates, confirmed via binary string extraction, which allows commands to be updated server-side without binary modification.
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS backdoor that disguises itself as legitimate Flutter-based productivity apps, uses a stub launcher plus a Dart payload library, receives live commands via a hidden WKWebView from attacker-controlled servers, performs hardware fingerprinting, hijacks Chrome search settings, and establishes persistence via the Sparkle update mechanism.
macOS malware delivered via Flutter that separates the static binary from the command payload by loading attacker-controlled web content in a WKWebView at runtime. JavaScript from the C2 communicates with a native Dart handler through the flutterInvoke bridge, enabling C2-conditional execution, hardware fingerprinting, Chrome preference hijacking, Sparkle-based persistence, and runtime command delivery.
Mac malware used in the Operation FlutterBridge malvertising campaign. It masquerades as legitimate apps, loads malicious code from the internet, hijacks Chrome by modifying Secure Preferences and redirecting searches/new tabs, kills and restarts Chrome with hidden settings, and provides backdoor capabilities including arbitrary command execution, file system interaction, environment variable exfiltration, and document theft via a fake AI summarization feature.
A macOS malware family that evolved from adware into a backdoor-capable threat. It masquerades as legitimate applications, uses a WebView-based JavaScript-to-native bridge to fetch malicious logic remotely, supports arbitrary terminal command execution, data exfiltration, local filesystem manipulation, browser preference hijacking, and covert document theft via a fake AI summarization feature.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.