Skip to content
ThreatCluster

FlutterShell Malware Targets macOS Users via Flutter Framework Exploitation

First seen 23 Jun 2026, 14:03 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 24, 2026 at 13:54 UTC
  • •FlutterShell malware disguises itself as legitimate macOS productivity apps.
  • •Active between December 2025 and March 2026, targeting Mac users.
  • •Utilizes the Flutter framework, complicating detection by security tools.

A new macOS malware named FlutterShell has been identified, leveraging the Flutter framework to disguise itself as legitimate applications. This backdoor targets Mac users, making detection difficult for traditional security tools. Active from December 2025 to March 2026, it has been linked to the CL-CRI-1089 cluster associated with Operation FlutterBridge. Researchers analyzed ten Mach-O samples, revealing its stealthy attack methods. The malware's ability to blend in with real software poses a significant risk to users. Current detection efforts are ongoing, and security professionals are urged to enhance monitoring for this threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 89d ago How this analysis works

Timeline

2025-12-01
FlutterShell malware becomes active
The malware begins targeting macOS users, disguising itself as legitimate applications.
Gbhackers
2026-03-01
FlutterShell malware identified
Researchers analyze ten Mach-O samples, revealing the malware's stealthy techniques.
Cybersecuritynews
2026-06-23
FlutterShell malware reported
Gbhackers and Cybersecuritynews publish findings on the malware's operation and detection.
Gbhackers

More articles in this cluster (2)

Following this threat?

Track FlutterShell in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3