Researchers uncovered a new campaign called Operation FlutterBridge, that uses malicious Google and YouTube ads to trick users into downloading fake software bundled with the FlutterShell backdoor. Once installed, attackers gain full access to the system.
thehackernews.com/2026/06/fl…
Die #macOS-Kampagne Operation FlutterBridge nutzt manipulierte Google- und YouTube-Anzeigen, um die neue Schadsoftware FlutterShell zu verbreiten.
it-daily.net/shortnews/macos…
FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads
Cybersecurity researchers have shed light on a macOS malvertising campaign codenamed Operation FlutterBridge that spreads a new backdoor called FlutterShell.
According to Palo Alto Networks Unit 42, the campaign is said to be the next stage of a previously reported activity cluster dubbed JSCoreRunner (aka FileRipple) in late August 2025. The cybercrime group behind the two attack chains is being tracked under the moniker CL-CRI-1089. The attackers are assessed to be active since at least 2023.
nuel.ink/yHhiYA