TLDR Tech / InfoSec
Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor
Unit 42 tracked Operation FlutterBridge, a financially motivated campaign that distributes the FlutterShell macOS backdoor via hundreds of Google-verified ads by shell companies (AdsParkPro LTD, Advantage Web Marketing LLC, and SOFT WE ART LIMITED). It uses notarized payloads such as PodcastsLounge, PDF-Brain, and PDF-Ninja, which have zero VirusTotal detections. FlutterShell stores logic off-binary in a WebView via a JavaScript-to-native bridge (flutterInvoke), fetching commands from /getConfig and /getUpdateThanksConfig for runtime behavior changes, fingerprints hosts via IOPlatformUUID, rewrites Chrome Secure Preferences to hijack search through sinterfumesco[.]com, abuses Sparkle for silent updates, and in later variants routes documents through /summarize-text, exfiltrating content under the guise of AI summarization. Defenders should hunt the C2 domains atsheisdomestic[.]org, etoftheappyrince[.]org, and healightejustb[.]org, plus the SHA256 hashes, flag killall "Google Chrome" relaunches with --hide-crash-restore-bubble and --disable-session-crashed-bubble, and treat valid Apple notarization as no guarantee of safety despite passing review.
Read the full story