Researchers at Palo Alto Networks Unit 42 have uncovered a new macOS malvertising operation they call Operation FlutterBridge, in which fake Mac apps advertised through hundreds of Google-verified ads install a previously unseen backdoor called FlutterShell. Malvertising means buying legitimate-looking online ads to lure people into downloading malware. The team (Ido Asher, Noa Dekel, and Tom Fakterman) ties the activity to a money-driven group it tracks as CL-CRI-1089, active since at least 2023 and previously linked to the JSCoreRunner macOS campaign (first seen in August 2025) and the RecipeLister and Calendaromatic Windows campaigns that other vendors grouped under the label "TamperedChef."
What's affected
The malware hides inside trojanized desktop apps, meaning real-looking programs with hidden malicious code. Unit 42 found three: a podcast player called PodcastsLounge and two PDF readers, PDF-Brain and PDF-Ninja. All three were signed with valid Apple Developer IDs and passed Apple's notarization checks, and at the time of analysis the PodcastsLounge sample had zero detections on VirusTotal. A telltale sign of shared origin: PDF-Brain's internal package was still named podcasts_lounge.
How the attack works
FlutterShell is built on Google's Flutter framework. Rather than baking its malicious logic into the app, it loads attacker-controlled web pages inside an embedded browser window (a WebView) and uses a bridge (the flutterInvoke channel) that turns commands from the remote page into actions on the Mac. The real instructions arrive from the operators' /getConfig and /getUpdateThanksConfig endpoints, so the attackers can change what the malware does at any time without shipping an app update. The implant can run commands, read and write files, and steal environment variables. Because Flutter compiles its code in a way that hides strings and variables, the researchers had to use a customized version of Worawit Wangwarunyoo's blutter tool to rebuild the logic, and they spotted unfinished functions suggesting the malware is still being developed.
The two PDF apps add a clever twist. Their "AI summarization" feature secretly doubles as a theft channel: instead of sending your document straight to an AI service, FlutterShell routes it through the attackers' server at hxxps://[attacker_domain]/summarize-text, which forwards it to an AI agent and returns a summary. You get your summary; the attackers keep a copy of every file.
On launch, the malware fingerprints the Mac (pulling its IOPlatformUUID via ioreg), then rewrites Google Chrome's Secure Preferences so searches and new tabs run through sinterfumesco[.]com before reaching a real search engine, generating ad money. It force-quits Chrome with killall "Google Chrome" and reopens it with flags like --restore-last-session, --hide-crash-restore-bubble, --noerrdialogs, and --disable-session-crashed-bubble to hide the warning banners that normally appear after a crash.
The ads themselves ran through shell companies (AdsParkPro LTD and Advantage Web Marketing LLC, plus a third, SOFT WE ART LIMITED, on the Windows side) posing as established Ukrainian and UK firms. Unit 42 found the operators waited about a year between registering Google Ads accounts and spending, an "aging" trick to dodge fraud filters. After AdsParkPro LTD's ads were pulled from the Google Ads Transparency Center on January 19, 2026, the group returned within two weeks under Advantage Web Marketing LLC with a fresh variant. Ads targeted English-speaking markets (U.S., Canada, Australia) and Western Europe (notably France and Germany). Google told Unit 42 it suspended the accounts for policy violations.
What you should do
Valid Apple signatures, clean notarization, and zero antivirus hits mean reputation-based defenses alone will not catch this. Only install Mac apps from trusted sources, and be wary of apps you found through search ads. Defenders should hunt for unexpected changes to Chrome's Secure Preferences, odd flutterInvoke WebView activity, and outbound traffic to the malware's three control domains (one per app): atsheisdomestic[.]org (PodcastsLounge), etoftheappyrince[.]org (PDF-Brain), and healightejustb[.]org (PDF-Ninja), plus the Chrome redirector sinterfumesco[.]com. Unit 42 expects more FlutterShell variants and warns that parallel Windows builds, while currently inert, point to a phased rollout.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.