FlutterShell Malware Targets macOS Users via Flutter Framework Exploitation

A new macOS malware named FlutterShell has been identified, leveraging the Flutter framework to disguise itself as legitimate applications. This backdoor targets Mac users, making detection difficult for traditional security tools. Active from December 2025 to March 2026, it has been linked to the CL-CRI-1089 cluster associated with Operation FlutterBridge. Researchers analyzed ten Mach-O samples, revealing its stealthy attack methods. The malware's ability to blend in with real software poses a significant risk to users. Current detection efforts are ongoing, and security professionals are urged to enhance monitoring for this threat.

Key Points: • FlutterShell malware disguises itself as legitimate macOS productivity apps. • Active between December 2025 and March 2026, targeting Mac users. • Utilizes the Flutter framework, complicating detection by security tools.