A macOS malvertising effort known as Operation FlutterBridge, which propagates a novel backdoor known as FlutterShell, has been exposed by cybersecurity researchers.
Palo Alto Networks Unit 42 reports that the campaign is the next phase of an activity cluster called JSCoreRunner (also known as FileRipple) that was first identified in late August 2025. Under the name CL-CRI-1089, the cybercrime gang responsible for the two attack chains is being monitored. It is determined that the attackers have been active since at least 2023.
FlutterShell, which is based on the Flutter framework, uses malicious desktop programs to infect targets with adware, according to Unit 42. The payload has backdoor capabilities, including as file system manipulation and shell command execution, in addition to its adware functionality.
Recipe Lister and Calendaromatic, two more operations linked to CL-CRI-1089, are part of a larger category called TamperedChef (also known as EvilAI), a continuous campaign that uses trojanized versions of productivity software to distribute adware read more about FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.