Operation FlutterBridge Uses Fake Google Ads to Spread macOS Backdoor

Palo Alto Networks Unit 42 reports on Operation FlutterBridge, a malvertising campaign that used fake, verified Google/YouTube ads and shell companies to push macOS apps (PodcastsLounge, PDF-Brain, PDF-Ninja) bundling a backdoor called FlutterShell; the malware loads remote JavaScript, hijacks Chrome via Secure Preferences to force ad-filled pages, can execute arbitrary commands, access files and exfiltrate environment data, and is under active development with multiple evolving variants.