FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads

A new macOS backdoor called FlutterShell spreads through malicious Google and YouTube advertisements in Operation FlutterBridge.

• •FlutterShell is built with the Flutter framework and delivers adware alongside backdoor capabilities for shell command execution and file system manipulation.
• •Uses WebView-based architecture with JavaScript-to-native bridge to dynamically update malicious logic without recompilation.
• •Signed with valid Apple Developer IDs and passed Apple notarization, bypassing security checks.
• •Hijacks Chrome browser configuration to force traffic through attacker-controlled ad-filled intermediary sites.
• •Three variants identified: PodcastsLounge, PDF-Brain, and PDF-Ninja, with PDF variants featuring AI-powered document summarization.