Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor

MITRE Techniques

• [T1218 ] System Binary Proxy Execution – The malware leverages legitimate system utilities like Chrome and update-related flows to carry out its activity and relaunch altered apps (‘killall “Google Chrome”‘ and ‘open command on the staged app bundle’).
• [T1059.007 ] JavaScript – The payload stores and executes malicious logic in remote JavaScript loaded by the WebView bridge (‘the malicious logic is stored on the attackers’ website’ and ‘JSON-formatted commands’).
• [T1027 ] Obfuscated Files or Information – Variants increasingly obfuscate strings and symbols to hinder analysis (‘some of its strings obfuscated’ and ‘used Flutter’s native –obfuscate flag’).
• [T1105 ] Ingress Tool Transfer – The malware retrieves configuration and update logic from attacker-controlled web endpoints (‘retrieve the core malicious logic from external endpoints: /getConfig and /getUpdateThanksConfig’).
• [T1021.003 ] Remote Services: SMB/Windows Admin Shares – Not mentioned.
• [T1222.001 ] File and Directory Permissions Modification: File System Permissions – The malware reads and writes files in sensitive locations such as Chrome preferences and the Downloads directory (‘modifies Google Chrome configuration files’ and ‘read and write to files in the user’s Downloads directory’).
• [T1114 ] Email Collection – Not mentioned.
• [T1056 ] Input Capture – Not mentioned.
• [T1041 ] Exfiltration Over C2 Channel – The malware forwards document content through attacker infrastructure before AI processing (‘forwards the content to the attackers’ C2 server’ for summarization).
• [T1071.001 ] Web Protocols – The malware communicates with attacker infrastructure over HTTP(S) endpoints and website content (‘HTTP GET request’ and ‘loads the attackers’ website’).
• [T1583.006 ] Acquire Infrastructure: Web Services – The attackers use Google Ads and shell-company infrastructure to distribute the malware (‘distributed via hundreds of Google-verified advertisements’).
• [T1036 ] Masquerading – The applications pose as legitimate podcast players and PDF viewers (‘masquerade as legitimate software’).
• [T1543.002 ] Create or Modify System Process: System Process – The malware forcefully terminates and relaunches Chrome and swaps app versions during updates (‘forces Chrome to connect’ and ‘programmatically executes the open command’).
• [T1204 ] User Execution – User interaction can trigger loading of the malicious pages through About or Update buttons (‘When the targeted user clicks the About or Update buttons’).