Hackers Deploy FlutterShell Backdoor Through Malvertising Campaigns

Threat actors operating under the CL-CRI-1089 cluster have significantly escalated their macOS targeting by deploying a new backdoor dubbed FlutterShell. This campaign, tracked as Operation FlutterBridge, represents an evolution from the group’s previous adware distribution efforts. The financially motivated attackers transitioned from delivering standard adware like JSCoreRunner to deploying highly capable backdoors through massive Google Ads campaigns. These targeted…