Operation FlutterBridge — FlutterShell macOS Backdoor via Malicious Google/YouTube Ads (CL-CRI-1089) — Threadlinqs Intelligence
As of 2026-06-06, Operation FlutterBridge — FlutterShell macOS Backdoor via Malicious Google/YouTube Ads (CL-CRI-1089) is a high-severity malware threat attributed to CL-CRI-1089, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0690 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: CL-CRI-1089 · FINANCIAL
Operation FlutterBridge is a macOS malvertising campaign distributing FlutterShell, a new Flutter-built backdoor, through malicious Google/YouTube ads fronted by Google-verified shell companies. Three
Unit 42 documented Operation FlutterBridge, a financially motivated macOS malvertising operation distributing FlutterShell — a backdoor built on Google's Flutter cross-platform framework and tracked under cybercrime cluster CL-CRI-1089 (active since at least 2023). FlutterShell is the next-stage successor to the JSCoreRunner/FileRipple family first observed in August 2025, sharing six identical core backdoor primitives, the same primary distributor (AdsParkPro LTD), and an identical JavaScript-to-native bridge architecture whose primary objective is Google Chrome browser hijacking.
DISTRIBUTION: Victims are lured via Google Ads and YouTube advertisements placed by Google-verified shell companies (AdsParkPro LTD, Advantage Web Marketing LLC, SOFT WE ART LIMITED). These entities were strategically aged before malicious use, exhibiting roughly a one-year latency between Google Ads account registration and first recorded ad spend to build advertising-platform trust. The ads front three trojanized applications masquerading as legitimate utilities: PodcastsLounge (podcast app), PDF-Brain and PDF-Ninja (PDF viewers). The campaign targets Western Europe and Anglophone markets.
SUPPLY-OF-TRUST ABUSE: All samples are signed with valid Apple Developer IDs (Yasar Sever / UBZDAAV97Y, Batuhan Dabag / FW9NHQ8922, Yusuf Bal / B73CHZ24Y8) and successfully passed Apple notarization. At analysis time, variants showed zero detections on VirusTotal, demonstrating abuse of Apple's automated security review and code-signing trust chain.
WEBVIEW JS-TO-NATIVE BRIDGE: FlutterShell's defining trait is the decoupling of malicious logic from the signed binary. Rather than hardcoding behavior, the app embeds a WebView that loads JavaScript from attacker infrastructure and exposes a native message channel named flutterInvoke. Remote JavaScript issues JSON-formatted commands across this bridge, which the native Flutter layer translates into system calls. Payload logic is fetched from /getConfig and /getUpdateThanksConfig endpoints, allowing the operators to modify behavior in real time without recompiling or re-notarizing the application.
EXECUTION & EVASION: On launch FlutterShell performs a calculated sandbox-evasion delay — it issues an HTTP GET to [domain]/api/update-delay to retrieve a dynamic delay duration (default 600 seconds if unreachable; 1200 seconds on a null response). Only after the delay expires does it load [domain]/update-thanks.html and begin contacting attacker infrastructure. Core capabilities exposed across the bridge include arbitrary shell command execution (exec_sync, pdf_sync, renderPDF), file read/write and directory enumeration, environment-variable exfiltration, and Chrome configuration tampering. Later variants (PDF-Brain, PDF-Ninja) add AI-summarization-based exfiltration that ships document content to a /summarize-text endpoint.
ADWARE / BROWSER HIJACK: FlutterShell modifies Chrome's 'Secure Preferences' file to hijack the default search engine and new-tab page to sinterfumesco[.]com, funneling victims through ad-filled intermediary sites for monetization.
PERSISTENCE / SILENT UPDATE: The malware abuses a modified Sparkle update framework. Instead of prompting the user, it programmatically runs the macOS open command against a staged app bundle in the cache directory and immediately terminates the old process, achieving silent self-upgrade.
VARIANT EVOLUTION: The three variants show progressive obfuscation maturity — PodcastsLounge uses plaintext strings and descriptive command names (e.g., read_file); PDF-Brain adds Base64 obfuscation; PDF-Ninja is compiled with Flutter's --obfuscate flag and uses deceptive PDF-themed command names to better blend past notarization. The cluster also overlaps with Windows strains RecipeLister and Calendaromatic distributed by the same shell companies, sharing WebView architecture, browser-hijack tactics, and related ad-intermediary domains.
Weaknesses (CWE)
CWE-829, CWE-494, CWE-749, CWE-940
Target sectors: consumer, technology, media, professional-services
Target regions: Western Europe, North America, United Kingdom
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1585, T1588, T1608, T1189, T1204, T1059, T1059, T1176, T1553