Operation FlutterBridge: The FlutterShell macOS Backdoor

This report analyzes ten macOS Mach-O artifacts from the CL-CRI-1089 cluster (Operation FlutterBridge), describing FlutterShell — a Flutter-based malware that uses a WKWebView to fetch JavaScript C2 payloads at runtime. Key findings include an invariant exported-symbol fingerprint across generations, heavy Dart AOT obfuscation in Gen 3, certificate rotation and notarization abuse to evade Gatekeeper, C2-conditional dormancy in sandboxes, concrete IOCs (domains, hashes, plugin-typo string), and recommended tiered detection rules for endpoint telemetry.