FlutterShell — Operation FlutterBridge (macOS Backdoor)

FlutterShell is a macOS backdoor distributed in a malvertising campaign Palo Alto Unit 42 codenamed Operation FlutterBridge (actor CL-CRI-1089, active since at least 2023; successor to the 2025 JSCoreRunner/FileRipple campaign). The crew buys Google and YouTube ads through a rotating set of Google-verified shell companies (e.g. AdsParkPro LTD, Advantage Web Marketing LLC, SOFT WE ART LIMITED → PACIFIC TRADE SOLUTIONS LTD), pushing fake desktop apps to macOS users in the US, Canada, Australia, France and Germany.

The malware is built with the Flutter framework and ships as notarized apps with valid Apple Developer IDs — masquerading as AI productivity tools: PodcastsLounge, PDF-Brain and PDF-Ninja. Its WebView architecture exposes a JavaScript-to-native bridge that grants arbitrary command execution, file-system manipulation, environment-variable exfiltration, system fingerprinting and browser-session theft. The malicious logic is pulled dynamically from attacker infrastructure, so the signed app body stays "clean" and the behavior can change without re-notarization. A core capability is Chrome traffic hijacking — the app rewrites Chrome configuration to route the victim's browsing through an attacker-controlled intermediary.

The strongest defensive angle on macOS is the post-install behavior: a freshly-installed "PDF/podcast" app modifying Google Chrome's preference files and spawning shells that read env vars and reach external infrastructure. Code-signing is no defense here — the apps are legitimately notarized — so hunt the behavior, not the signature.

Defender priority: Hunt macOS endpoints for the app bundles PodcastsLounge / PDF-Brain / PDF-Ninja, any non-Chrome process modifying Chrome's Preferences/Secure Preferences, and LaunchAgent persistence written by these apps. No public hashes/C2 were released — detection is behavior-led; fill §10 as Unit 42 publishes atomics.

No atomic IOCs (file hashes, C2 domains/IPs, exact bundle IDs) were published in the available reporting. This pack is behavior-led; §10 uses REPLACE_WITH_* placeholders so atomics drop in unmodified when Unit 42 releases its appendix. Nothing here is fabricated.

Hunt Hypotheses (fidelity-ordered)

1. H1 (high): An app bundle named PodcastsLounge / PDF-Brain / PDF-Ninja executes from /Applications or a user Downloads path.
2. H2 (high): A non-Chrome process rewrites Chrome Preferences / Secure Preferences — the traffic-hijack step.
3. H3 (high): A LaunchAgent/LaunchDaemon plist is written referencing one of the masquerading apps (persistence).
4. H4 (medium): A FlutterShell app spawns /bin/sh/bash running curl/env — arbitrary command exec + env-var exfil via the JS bridge.
5. H5 (medium): The app fetches its dynamic payload from external infra shortly after first launch.
6. H6 (low): Quarantine attribute / first-run of a notarized "PDF/podcast" app downloaded via an ad click.

Attack Chain

• macOS Unified Log / MDM: Inventory installed apps for PodcastsLounge, PDF-Brain, PDF-Ninja (and any AI PDF/podcast app installed via ad click); flag those with recently-issued Developer IDs.
• LaunchAgents/Daemons sweep: Enumerate ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons for plists pointing at these app bundles.
• Chrome config integrity: Diff ~/Library/Application Support/Google/Chrome/Default/Preferences and Secure Preferences against a known-good baseline; look for injected proxy / startup-URL entries.
• Secure web gateway: Hunt ad click-throughs to non-official "PDF tool" download domains and alert on first-seen app-download domains advertised via Google/YouTube.

Q1 is the strongest IOA promotion candidate. Q2/Q4 promote after the MDM-agent exclusions are validated. Falcon macOS sensor coverage is a prerequisite for all of these.

1 · Hunt the masquerade apps + LaunchAgents across a Mac (shell)

#!/bin/bash
# masquerade app bundles
mdfind "kMDItemKind == 'Application'" 2>/dev/null | grep -Ei 'PodcastsLounge|PDF-Brain|PDF-Ninja'
ls -la /Applications | grep -Ei 'PodcastsLounge|PDF-Brain|PDF-Ninja'
# persistence
for d in ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons; do
  grep -lEi 'PodcastsLounge|PDF-Brain|PDF-Ninja|flutter' "$d"/*.plist 2>/dev/null
done

2 · Check Chrome preference integrity (shell)

PREF="$HOME/Library/Application Support/Google/Chrome/Default/Secure Preferences"
[ -f "$PREF" ] && /usr/bin/python3 -c 'import json,sys;d=json.load(open(sys.argv[1]));print(d.get("proxy"),d.get("session",{}).get("startup_urls"))' "$PREF"

3 · Remove a confirmed FlutterShell app + persistence (shell)

sudo rm -rf "/Applications/PDF-Ninja.app" "/Applications/PDF-Brain.app" "/Applications/PodcastsLounge.app"
for d in ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons; do
  grep -lEi 'PodcastsLounge|PDF-Brain|PDF-Ninja|flutter' "$d"/*.plist 2>/dev/null | xargs -r sudo rm -f
done

Capture the .app bundle and its Info.plist (Developer ID / Team ID) for hashing and abuse-reporting to Apple before deletion — that Team ID is your tenant-local atomic IOC.

Coverage is strong on the app-execution, Chrome-hijack and persistence anchors (Q1/Q2/Q3) and weaker on the in-WebView JS logic and the dynamic-payload C2 (no published infra). All queries assume Falcon's macOS sensor is deployed — without it this pack has no telemetry. Validation gates (§11) must pass before promoting Q1 to a Custom IOA.