Security researchers have uncovered a sophisticated macOS malware family dubbed FlutterShell.
Tracked under the threat cluster CL-CRI-1089 and associated with Operation FlutterBridge, this campaign relies heavily on the legitimate Flutter framework to mask its malicious activities.
Active between December 2025 and March 2026, the malware primarily targets macOS users for financial gain through browser search hijacking.
Initial access is typically gained through malvertising on Google and YouTube, where users are tricked into downloading fake podcast applications or PDF converters.
The core of FlutterShell’s operation lies in its deliberate separation of the static binary from the command payload.
Every deployment follows a consistent two-component architecture, utilizing a thin Mach-O stub launcher that loads a large dynamic payload library containing the Dart runtime.
The malware initializes a WKWebView to load an attacker-controlled landing page. Using the JavaScript message channel known as the FlutterInvoke bridge, the web view passes commands directly to a native Dart handler.
This dynamic delivery ensures the actual command payload is never present in the static binary.
macOS Backdoor Executes Commands
One of the most notable features of FlutterShell is its C2-conditional execution model. During automated sandbox testing, earlier generations of the malware consistently timed out without exhibiting any malicious behavior.
Because the JavaScript payload must be delivered via a live command-and-control (C2) server, the binary remains completely dormant in isolated or simulated environments.
Without a network response, the malware simply presents a benign, functioning user interface to the victim.
To stay ahead of security defenses, the threat actors employed aggressive Apple Developer certificate rotation and advanced obfuscation.
Analysis of three distinct malware generations reveals that developers enrolled new certificates before older ones were revoked.
The binary file size grew by nearly 50% between the first two generations, driven entirely by the expansion of private Dart AOT code.
By the third generation, the attackers abandoned Apple’s notarization entirely in favor of self-signed artifacts.
According to levelblue research, despite these robust evasion tactics, security analysts identified several structural invariances that offer highly durable detection surfaces.
Because the threat actors reused the same Flutter framework base across all generations, the exported symbol fingerprint remained identical.
This invariant property allows defenders to utilize a single, generation-agnostic detection rule that survives certificate rotations and payload alterations.
Researchers also discovered a persistent plugin spelling error inside the binary strings. The typo “path_providerr” featuring a double ‘r’ appears across multiple generations.
This mistake provides a reliable static fingerprint for threat hunters as long as the attackers continue compiling from the same source tree.
Indicators of Compromise
| Category | Indicator | Context |
|---|---|---|
| Network Domain | atsheisdomestic.org | Gen 1 C2 |
| Network Domain | etoftheappyrince.org | Gen 2 C2 |
| Network Domain | healightejustb.org | Gen 3 C2 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
