FlutterShell macOS Backdoor Abuses Flutter Framework and WKWebView for Stealthy Attacks

A newly analyzed macOS backdoor called FlutterShell has been quietly targeting Mac users by disguising itself as legitimate productivity apps.

It abuses Google’s Flutter app development framework to blend in with real software, making it far harder to detect using traditional security tools.

The malware was active between December 2025 and March 2026, with researchers tracking three distinct generations of the threat.

The campaign, tracked under the name Operation FlutterBridge and the cluster identifier CL-CRI-1089, spread through malicious Google and YouTube advertisements.

The ads targeted users searching for terms like “podcast app for Mac” or “free PDF converter,” redirecting them to fake sites hosting digitally signed app bundles.

Since the apps carried valid Apple Developer certificates at distribution time, macOS Gatekeeper passed them without raising any warning.

Analysts at LevelBlue, in a report shared with Cyber Security News (CSN), conducted an in-depth static analysis of ten Mach-O binary samples collected across all three generations.

Rather than re-examining the broader campaign, the team focused on what those binaries revealed about the malware’s design, its evolution, and how defenders can reliably detect it as the actor rotates its infrastructure.

At its core, FlutterShell splits its work across two components: a small stub launcher that initializes the Flutter runtime, and a large payload library containing the actual Dart code and attack logic.

The payload library weighs around 10 MB and carries the full Flutter framework alongside custom commands. This structure helps the malware pass basic inspection because the launcher looks nearly identical to any legitimate Flutter application.

What makes FlutterShell especially difficult to catch in automated sandboxes is its C2-conditional design. The malware only activates when it receives live instructions from an attacker-controlled server.

In every sandbox test, the binary launched cleanly, displayed a working app interface, and then produced no activity at all. Without a live server to respond, the malware sits idle and appears completely harmless.

FlutterShell macOS Backdoor Abuses Flutter Framework and WKWebView

The most notable aspect of FlutterShell is how it receives commands from its operators.

Rather than hardcoding instructions in the binary, the malware opens a hidden WKWebView window and loads a page from an attacker-controlled domain.

That page then delivers JavaScript to the app, which passes commands through a named message channel called flutterInvoke.

This design means operators can update what the malware does at any time by simply changing their server content, without touching the binary.

The bridge command was named exec_sync in the first generation, renamed pdf_sync in the second, and became renderPDF in the third, camouflaging activity as normal behavior from a PDF application.

Any detection rule tied to a specific command name will break the moment the actor pushes a server-side update.

Cross-Generation Evasion and Persistence Tactics

What stands out across all three generations is how deliberately the actor rotated its identity. Apple revoked the first developer certificate on December 31, 2025, and a new generation appeared twelve days later with a fresh one.

A second revocation followed on January 31, 2026, and a third generation arrived in March using a self-signed certificate, trading Gatekeeper clearance for independence from Apple’s certificate authority.

Once connected to a live server, FlutterShell is assessed to perform hardware fingerprinting by running a system command that harvests the Mac’s unique hardware identifier.

It then modifies Chrome’s settings to silently swap the default search engine for an attacker-controlled domain, kills Chrome, and relaunches it with flags that hide any crash warning from the user.

Persistence is achieved by staging a replacement bundle in a local cache folder through the Sparkle update mechanism and quietly installing it.

The LevelBlue team recommends prioritizing behavioral endpoint detection over static signatures, since Generation 3 evaded most pattern-based tools after certificate rotation and Dart symbol obfuscation.

Monitoring for non-browser processes making outbound HTTPS connections to unknown domains, unusual child processes harvesting hardware identifiers, and unexpected writes to Chrome’s profile directory are the most reliable detection signals available.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.