Trusted Design

Operation FlutterBridge: The FlutterShell macOS Backdoor

概要

FlutterShell is a macOS backdoor campaign active from December 2025 to March 2026, identified as cluster CL-CRI-1089 under Operation FlutterBridge. The threat actors deliberately misused the Flutter framework to deliver malware through malvertising campaigns on Google and YouTube. The malware employs a two-component architecture: a thin Mach-O launcher and a large Flutter payload dylib. Across three generations, the operators rotated Apple Developer certificates, implemented progressive Dart obfuscation, and renamed bridge commands to evade detection. The backdoor uses a WKWebView to load attacker-controlled JavaScript from C2 servers, implementing a conditional execution model where commands are delivered at runtime via a JavaScript-to-native bridge called flutterInvoke. The primary impact includes Chrome browser hijacking to inject sinterfumesco[.]com as the default search provider and persistent infection through silent Sparkle framework updates.

Created: 2026-06-19

Indicators

• FileHash-MD5 - b4aa7255af4b016586090a5b451300fa -
• FileHash-MD5 - ffd773f157df70291f0910a45a1d8d9a -
• URL - https://atsheisdomestic.org/api/update-delay -
• FileHash-SHA256 - f544bfab72d380cc20692d8ec9d31ea666785fe225dccd55beab29a3c0fdfad2 -
• FileHash-MD5 - 605169623267c4eb73693b22b811dc7a -
• URL - https://etoftheappyrince.org/api/update-delay -
• domain - healightejustb.org -
• URL - https://etoftheappyrince.org/update-thanks.html -
• FileHash-SHA1 - bb1e6e2650d3d77d732c5eb5176011f914dd87df -
• FileHash-SHA256 - 363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc34 -
• domain - etoftheappyrince.org -
• URL - https://healightejustb.org/checkForNewVersion -
• URL - https://atsheisdomestic.org/api/podcasts -
• FileHash-SHA256 - cc4f048e66c5ab3c0f1d767bb8fc464d082641f4888ea3cd14ea3775077c4bf2 -
• FileHash-SHA1 - a247a63644c3475f436d076f55523ea39afd8c41 -
• URL - https://healightejustb.org/summarize-text -
• domain - atsheisdomestic.org -
• FileHash-MD5 - 638b0a77a6d686849a78b500adf5e565 -
• FileHash-SHA1 - c40126fea6ed24652a3e4e19205075cb02cca3e2 -
• URL - https://etoftheappyrince.org/... -
• URL - https://etoftheappyrince.org/summarize-text -
• FileHash-SHA256 - 134517796178a150a1585672be134169d6877082b598d840baa3f37b0222be26 -
• URL - https://etoftheappyrince.org/api/pdfs -
• URL - https://healightejustb.org/api/central-config -
• URL - https://etoftheappyrince.org -
• URL - https://healightejustb.org/welcome_page.js -
• FileHash-SHA256 - 2c5bc9e95e1e9b73e3ba8870a008802899866a2c0e2e10112aefddf7a96af04e -
• FileHash-SHA256 - bf90fb31e6024d7e6616f5acd0e8aa28738a9095a508c1a986e1e974cb9e79a0 -
• URL - https://atsheisdomestic.org/update-thanks.html -
• hostname - event.process.parent.name -
• FileHash-SHA256 - fc091ddb4d845280aeb7745cfdb6b7cb0013abc35db9e634f055b8e8fb0b5b1e -
• domain - sinterfumesco.com -
• URL - https://healightejustb.org/welcome_page.html -
• FileHash-SHA256 - 32da1437a2734224406c7e5e8d756f0c0cd58c0c959478571cbfc0cd564d018a -
• URL - https://atsheisdomestic.org/api/subscribe -
• FileHash-SHA256 - 6c3f61d46d4de26b9cb16808bf17c33ae69f651a4b879e7b5612ff7f548e2a82 -
• hostname - event.process.name -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る