Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor

Operation FlutterBridge is an active global malvertising campaign that uses hundreds of Google-verified advertisements and shell companies to distribute FlutterShell — a notarized macOS application built with the Flutter framework that loads malicious JavaScript from attacker-controlled sites via a WebView JavaScript-to-native bridge. FlutterShell functions as adware and a full backdoor (arbitrary shell execution, file system manipulation, environment harvesting) and can exfiltrate document contents by proxying them through an attacker-controlled AI summarization endpoint; the report includes technical analysis, variant evolution, indicators of compromise (hashes and domains), and recommended mitigations.