FlutterShell backdoor targets macOS through malvertising ads

The article discusses an active cybercrime campaign named Operation FlutterBridge, which targets macOS users via malvertising. This campaign introduces a new backdoor malware named FlutterShell, capable of masquerading as legitimate applications while executing malicious shell commands and manipulating files. It evolved from a prior campaign (JSCoreRunner), shifting from standard adware to a more complex backdoor involving AI capabilities for data exfiltration.

The attackers employed a network of shell companies to distribute ads on Google, circumventing security measures. The FlutterShell malware utilizes a dynamic WebView architecture to load malicious code, allowing real-time changes without requiring software updates. The piece also details the malware's deployment strategies, technical analysis, and its operational ties to other malware strains. It concludes with recommendations on how Palo Alto Networks products can mitigate these threats.