FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads
A macOS malvertising effort known as Operation FlutterBridge, which propagates a novel backdoor known as FlutterShell, has been exposed by cybersecurity researchers.
Palo Alto Networks Unit 42 reports that the campaign is the next phase of an activity cluster called JSCoreRunner (also known as FileRipple) that was first identified in late August 2025. Under the name CL-CRI-1089, the cybercrime gang responsible for the two attack chains is being monitored. It is determined that the attackers have been active since at least 2023.
FlutterShell, which is based on the Flutter framework, uses malicious desktop programs to infect targets with adware, according to Unit 42. The payload has backdoor capabilities, including as file system manipulation and shell command execution, in addition t...