Threat actors operating under the CL-CRI-1089 cluster have significantly escalated their macOS targeting by deploying a new backdoor dubbed FlutterShell.
This campaign, tracked as Operation FlutterBridge, represents an evolution from the group’s previous adware distribution efforts.
The financially motivated attackers transitioned from delivering standard adware like JSCoreRunner to deploying highly capable backdoors through massive Google Ads campaigns.
These targeted campaigns heavily focus on English-speaking and Western European markets.
Built using the open-source Flutter framework, the malware relies on malicious desktop applications that masquerade as benign software.
Researchers have identified fully functional applications posing as podcast players and PDF viewers, specifically named PodcastsLounge, PDF-Brain, and PDF-Ninja.
Because these applications are signed with valid Apple Developer IDs and successfully pass Apple’s notarization checks, they easily bypass initial security warnings and remain undetected on common antivirus platforms.
FlutterShell Spreads Through Malvertising
FlutterShell bypasses traditional static analysis by avoiding hardcoded malicious logic within the application binary.
The developers implemented a WebView-based architecture that utilizes a JavaScript-to-native bridge to communicate with external attacker-controlled infrastructure.
This dynamic design allows the attackers to host their primary malicious scripts on external websites and alter the backdoor’s behavior in real time without recompiling the application.
When a user opens the infected application, the malware waits for a specific duration specified by the command-and-control server to avoid sandbox analysis.
It then injects a JavaScript bridge using a message channel called flutterInvoke, which translates JSON-formatted commands from the external webpage into native system calls. These commands grant the attackers complete control over the infected macOS host.
Despite possessing advanced backdoor functionalities, current FlutterShell variants primarily execute adware routines designed for browser hijacking. Upon execution, the malware fingerprints the infected system by collecting its hardware identifier.
It then specifically targets the Google Chrome Secure Preferences file, which typically serves as a defense against unauthorized changes to settings.
FlutterShell modifies the search provider data within this file to automatically route all user traffic through an attacker-controlled intermediary domain.
To force these changes immediately, the malware terminates the Google Chrome process and restarts it with specialized command-line arguments.
These arguments suppress standard crash warnings and seamlessly connect the user to the hijacked search environment, unit42 said.
The actors behind CL-CRI-1089 distributed this malware at scale through a network of Google-verified shell companies.
Entities like AdsParkPro LTD and Advantage Web Marketing LLC were registered years in advance and allowed to age, thereby bypassing initial fraud-detection filters.
These shell corporations maintain minimal digital footprints but act as legitimate fronts to purchase hundreds of Google advertisements.
Indicators of Compromise
| Indicator Type | Value | Context / Description |
|---|---|---|
| SHA256 | 021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b845 | PodcastsLounge.dmg installer |
| SHA256 | 363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc34 | podcasts_lounge.app executable |
| SHA256 | 8421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b2533109 | PodcastsLounge dynamic library (dylib) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
