FlutterShell macOS Backdoor Abuses Flutter Framework and WKWebView for Stealthy Attacks

Cybersecuritynews •Tushar Subhra Dutta • June 23, 2026

A newly analyzed macOS backdoor called FlutterShell has been quietly targeting Mac users by disguising itself as legitimate productivity apps. It abuses Google’s Flutter app development framework to blend in with real software, making it far harder to detect using traditional security tools. The malware was active between December 2025 and March 2026, with researchers […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FlutterShell Malware Targets macOS Users via Flutter Framework Exploitation A new macOS malware named FlutterShell has been identified, leveraging the Flutter framework to disguise itself as legitimate applications. This backdoor targets Mac users, making detection difficult for traditional security tools. Active from December 2025 to March 2026, it has been linked to the CL-CRI-1089 cluster associated with Operation FlutterBridge. Researchers analyzed ten Mach-O samples, revealing its stealthy attack methods. The malware's ability to blend in with real software poses a significant risk to users. Current detection efforts are ongoing, and security professionals are urged to enhance monitoring for this threat. 2 sources 61

Extracted Entities

FlutterShell macOS Backdoor Abuses Flutter Framework and WKWebView for Stealthy Attacks

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)