Operation FlutterBridge is a widespread macOS malvertising campaign operated by the CL-CRI-1089 threat cluster, delivering a novel Flutter-based backdoor dubbed FlutterShell. The malware utilizes a dynamic WebView-based JavaScript-to-native bridge to execute arbitrary commands, hijack Google Chrome for adware revenue, and exfiltrate data, all while masquerading as legitimate, Apple-notarized applications.
Adware
3 posts
Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor Tracking TamperedChef Clusters via Certificate and Code Reuse TamperedChef (also known as EvilAI) is a widespread threat campaign distributing trojanized productivity applications via malvertising. The threat actors heavily abuse legitimate code-signing certificates and employ delayed execution techniques to evade detection, ultimately deploying information stealers, RATs, or adware onto victim endpoints after a dormancy period.
When PUPs Grow Fangs: Dragon Boss Solutions Left an Open Door on 25,000+ Endpoints A potentially unwanted program (PUP) signed by Dragon Boss Solutions LLC utilizes a silent update mechanism to deploy a sophisticated AV-killing PowerShell payload. The updater's primary domain was left unregistered, creating a severe supply chain vulnerability that exposed over 25,000 endpoints to arbitrary code execution before being sinkholed by researchers.
