Loading story…
Palo Alto Networks Unit 42 reported that a cybercrime cluster tracked as CL-CRI-1089 is running a large macOS malvertising operation that delivers a new Flutter-based backdoor called FlutterShell. The campaign uses hundreds of Google Ads placed through verified shell companies to lure users in Anglophone and Western European markets into downloading trojanized applications posing as legitimate desktop tools, including variants identified as PodcastsLounge, PDF-Brain, and PDF-Ninja. Once installed, FlutterShell can execute shell commands, manipulate files, and exfiltrate environment variables, while also altering Google Chrome preferences to hijack browser traffic for ad monetization.
Researchers said the malware relies on a WebView JavaScript-to-native bridge that lets operators host malicious logic remotely and update behavior without recompiling the binary, making static analysis harder and enabling rapid changes in the campaign. Unit 42 linked FlutterShell to earlier CL-CRI-1089 activity on macOS, including JSCoreRunner, and to Windows malware families RecipeLister and Calendaromatic, indicating an expanding cross-platform operation. The findings also echo prior reporting on macOS adware loaders such as Bundlore, underscoring the continued use of deceptive software distribution and browser-focused monetization techniques against Apple users.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that the cybercrime cluster CL-CRI-1089, later tied to Operation FlutterBridge, has been active since at least 2023.
Researchers disclosed that FlutterShell uses a WebView-based JavaScript-to-native bridge to fetch remotely hosted malicious logic, and that some variants also hijack Chrome traffic, execute shell commands, manipulate files, and exfiltrate data including AI-summarized document contents.
Unit 42 attributed Operation FlutterBridge to the cybercrime cluster CL-CRI-1089 and linked the campaign to earlier macOS JSCoreRunner activity and Windows malware families RecipeLister and Calendaromatic.
Unit 42 described an increasingly widespread malvertising campaign targeting macOS in which hundreds of Google Ads placed by verified shell companies delivered the FlutterShell backdoor disguised as legitimate desktop applications.
Unit 42 said the macOS malvertising campaign distributing FlutterShell was still active in March 2026. The campaign targeted users in the United States, Canada, Australia, France, and Germany.
Confiant published an analysis of a new macOS Bundlore loader, documenting malware activity affecting macOS users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecommunity.gurucul.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.confiant.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **FlutterShell**, a macOS backdoor tied to **Operation FlutterBridge** and tracking cluster `CL-CRI-1089`, which was distributed through malicious Google and YouTube ads leading users to fake download sites for trojanized productivity apps. The malware arrived as digitally signed app bundles and used a two-part design: a lightweight launcher loaded a larger Flutter/Dart payload library, while a hidden `WKWebView` fetched attacker-controlled JavaScript from live command-and-control infrastructure to deliver commands at runtime. Analysis of ten Mach-O samples found three malware generations that changed certificates, lures, infrastructure, and command names, with the latest version adding full Dart symbol obfuscation to reduce static visibility. Despite those changes, researchers identified stable traits across payloads, including a shared exported-symbol fingerprint and consistent Flutter runtime behavior. Reported capabilities included hardware UUID fingerprinting, Chrome Secure Preferences modification to hijack browser search settings, persistence via `LaunchAgent`, and Sparkle-based silent replacement, indicating a financially motivated campaign that relied on behavioral stealth and server-side control.
Jun 29, 2026
Security researchers reported an active macOS social-engineering campaign that abuses **Google Search sponsored results** and Google-hosted content (notably `docs.google.com`, and also `business.google.com`) to funnel users to **forged Apple Support-like pages** and other lookalike content (including Medium posts). The pages instruct victims—often searching for “mac cleaner” tools or macOS maintenance tasks like clearing cache—to copy/paste an **obfuscated Base64** command into **Terminal**, which then downloads and executes a follow-on script with the user’s permissions. Once executed, the payload can enable remote access and data theft, including harvesting sensitive files and **SSH keys**, and may also deploy additional malware or cryptomining. One report ties the activity to delivery of the **AMOS (aka SOMA) stealer**, which was observed creating artifacts such as `.agent` (AppleScript used to run theft), `.mainHelper` (Mach-O binary), and `.pass` (password stored in plaintext), and attempting to access user data including **Documents** and **Notes**. Researchers also noted the apparent use of **compromised, Google-verified advertiser accounts** to place the malicious ads, helping the campaign bypass ad-platform trust checks.
Jun 29, 2026
A sophisticated cybercriminal campaign has been identified targeting macOS users, particularly developers, by leveraging fake download portals that impersonate trusted platforms such as Homebrew, LogMeIn, and TradingView. The attackers have registered over 85 domains that closely mimic the legitimate sites of these popular tools, using convincing branding and user interfaces to deceive visitors. These malicious domains are promoted through Google Ads, ensuring that they appear prominently in search results and increasing the likelihood that unsuspecting users will visit them. Once on the fake sites, users are instructed to copy and execute a curl command in their Terminal, which initiates the download and installation of infostealing malware. The primary payloads delivered in this campaign are AMOS (Atomic macOS Stealer) and Odyssey Stealer, both of which are capable of harvesting sensitive information such as system details, browser data, and cryptocurrency credentials from infected machines. The campaign employs advanced social engineering tactics, including clipboard manipulation and command obfuscation, to increase the success rate of infections. Researchers from Hunt.io have mapped the infrastructure supporting this operation, noting that the attackers reuse IP addresses and SSL certificates across multiple domains, indicating a persistent and well-organized effort. The infrastructure has been active for several years, with some IP addresses registered under personal names, suggesting a degree of operational continuity and experience. The campaign does not rely on exploiting software vulnerabilities but instead exploits user trust in widely used open-source and financial tools. The use of Google Ads as a distribution vector highlights the attackers' willingness to invest in paid advertising to reach their targets. The campaign's focus on the developer community is particularly concerning, as compromised developer systems could lead to broader supply chain risks. Security researchers have emphasized the importance of verifying download sources and being wary of unsolicited installation instructions, especially those involving Terminal commands. The ongoing nature of the campaign, with continuous adaptation of infrastructure and tactics, underscores the need for vigilance among macOS users. The discovery of this campaign began with public reports from independent researchers, which were then corroborated and expanded upon by threat intelligence teams. The scale and persistence of the operation suggest that it is likely to continue evolving, posing a significant threat to the macOS ecosystem. Organizations are advised to educate users about the risks of malvertising and to implement technical controls to block access to known malicious domains. The campaign demonstrates the increasing sophistication of social engineering attacks targeting macOS, a platform often perceived as less vulnerable than Windows.
Jun 29, 2026