FlutterShell Malware Uses C2

Gbhackers •Mayura Kathir • June 23, 2026

Targeted macOS endpoint monitoring, the CL-CRI-1089 cluster tied to Operation FlutterBridge repurposes the Flutter framework to deliver a novel macOS malware family dubbed FlutterShell. Rather than rehashing prior campaign reporting, this piece treats recovered artifacts as a technical detection case study built from static analysis of ten Mach‑O samples collected between December 2025 and March […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FlutterShell Malware Targets macOS Users via Flutter Framework Exploitation A new macOS malware named FlutterShell has been identified, leveraging the Flutter framework to disguise itself as legitimate applications. This backdoor targets Mac users, making detection difficult for traditional security tools. Active from December 2025 to March 2026, it has been linked to the CL-CRI-1089 cluster associated with Operation FlutterBridge. Researchers analyzed ten Mach-O samples, revealing its stealthy attack methods. The malware's ability to blend in with real software poses a significant risk to users. Current detection efforts are ongoing, and security professionals are urged to enhance monitoring for this threat. 2 sources 61

Extracted Entities

FlutterShell Malware Uses C2

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)