# Operation FlutterBridge — FlutterShell macOS Backdoor via Malicious Google/YouTube Ads (CL-CRI-1089)

> Operation FlutterBridge is a macOS malvertising campaign distributing FlutterShell, a new Flutter-built backdoor, through malicious Google/YouTube ads fronted by Google-verified shell companies. Three trojanized, Apple-notarized apps (PodcastsLounge, PDF-Brain, PDF-Ninja) use a WebView JS-to-native bridge to fetch attacker logic remotely, enabling shell execution, file system manipulation, env-var exfiltration, adware, and Chrome hijacking. Tracked as cybercrime cluster CL-CRI-1089.

- **Published:** 2026-06-06T00:00:00Z
- **Last reviewed:** 2026-06-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0690
- **ID:** TL-2026-0690
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** CL-CRI-1089
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Unit 42 documented Operation FlutterBridge, a financially motivated macOS malvertising operation distributing FlutterShell — a backdoor built on Google's Flutter cross-platform framework and tracked under cybercrime cluster CL-CRI-1089 (active since at least 2023). FlutterShell is the next-stage successor to the JSCoreRunner/FileRipple family first observed in August 2025, sharing six identical core backdoor primitives, the same primary distributor (AdsParkPro LTD), and an identical JavaScript-to-native bridge architecture whose primary objective is Google Chrome browser hijacking.

DISTRIBUTION: Victims are lured via Google Ads and YouTube advertisements placed by Google-verified shell companies (AdsParkPro LTD, Advantage Web Marketing LLC, SOFT WE ART LIMITED). These entities were strategically aged before malicious use, exhibiting roughly a one-year latency between Google Ads account registration and first recorded ad spend to build advertising-platform trust. The ads front three trojanized applications masquerading as legitimate utilities: PodcastsLounge (podcast app), PDF-Brain and PDF-Ninja (PDF viewers). The campaign targets Western Europe and Anglophone markets.

SUPPLY-OF-TRUST ABUSE: All samples are signed with valid Apple Developer IDs (Yasar Sever / UBZDAAV97Y, Batuhan Dabag / FW9NHQ8922, Yusuf Bal / B73CHZ24Y8) and successfully passed Apple notarization. At analysis time, variants showed zero detections on VirusTotal, demonstrating abuse of Apple's automated security review and code-signing trust chain.

WEBVIEW JS-TO-NATIVE BRIDGE: FlutterShell's defining trait is the decoupling of malicious logic from the signed binary. Rather than hardcoding behavior, the app embeds a WebView that loads JavaScript from attacker infrastructure and exposes a native message channel named flutterInvoke. Remote JavaScript issues JSON-formatted commands across this bridge, which the native Flutter layer translates into system calls. Payload logic is fetched from /getConfig and /getUpdateThanksConfig endpoints, allowing the operators to modify behavior in real time without recompiling or re-notarizing the application.

EXECUTION & EVASION: On launch FlutterShell performs a calculated sandbox-evasion delay — it issues an HTTP GET to [domain]/api/update-delay to retrieve a dynamic delay duration (default 600 seconds if unreachable; 1200 seconds on a null response). Only after the delay expires does it load [domain]/update-thanks.html and begin contacting attacker infrastructure. Core capabilities exposed across the bridge include arbitrary shell command execution (exec_sync, pdf_sync, renderPDF), file read/write and directory enumeration, environment-variable exfiltration, and Chrome configuration tampering. Later variants (PDF-Brain, PDF-Ninja) add AI-summarization-based exfiltration that ships document content to a /summarize-text endpoint.

ADWARE / BROWSER HIJACK: FlutterShell modifies Chrome's 'Secure Preferences' file to hijack the default search engine and new-tab page to sinterfumesco[.]com, funneling victims through ad-filled intermediary sites for monetization.

PERSISTENCE / SILENT UPDATE: The malware abuses a modified Sparkle update framework. Instead of prompting the user, it programmatically runs the macOS open command against a staged app bundle in the cache directory and immediately terminates the old process, achieving silent self-upgrade.

VARIANT EVOLUTION: The three variants show progressive obfuscation maturity — PodcastsLounge uses plaintext strings and descriptive command names (e.g., read_file); PDF-Brain adds Base64 obfuscation; PDF-Ninja is compiled with Flutter's --obfuscate flag and uses deceptive PDF-themed command names to better blend past notarization. The cluster also overlaps with Windows strains RecipeLister and Calendaromatic distributed by the same shell companies, sharing WebView architecture, browser-hijack tactics, and related ad-intermediary domains.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1176 Software Extensions
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1491 Defacement

## Sources

- [Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/)
- [FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads](https://thehackernews.com/2026/06/fluttershell-backdoor-spreads-to-macos.html)
- [MITRE ATT&CK — User Execution: Malicious File (T1204.002)](https://attack.mitre.org/techniques/T1204/002/)
- [MITRE ATT&CK — Modify Registry / Browser config tampering reference](https://attack.mitre.org/techniques/T1176/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0690