FlutterShell Malware Uses C2-Delivered JavaScript Payloads to Evade Sandbox Detection

Targeted macOS endpoint monitoring, the CL-CRI-1089 cluster tied to Operation FlutterBridge repurposes the Flutter framework to deliver a novel macOS malware family dubbed FlutterShell.

Rather than rehashing prior campaign reporting, this piece treats recovered artifacts as a technical detection case study built from static analysis of ten Mach‑O samples collected between December 2025 and March 2026.

Across three generations and both x86_64 and arm64 architectures, the threat demonstrates a deliberate separation of static binary and malicious command payload: a WKWebView-based WebView fetches attacker-delivered JavaScript at runtime and signals a native Dart handler through a JavaScript message channel (flutterInvoke).

That design yields minimal observable runtime behavior in isolated sandbox detonations when the C2 server is absent, producing benign UIs and frequent sandbox “timeouts” despite successful process launches.

Ten analyzed artifacts reveal stable detection surfaces amid active evasion. All six payload dylibs share an identical exported-symbol fingerprint, enabling a generation‑agnostic static rule as long as the actor continues to reuse the Flutter runtime base.

Structural hashing produces architecture-keyed clusters one for x86_64, another for arm64 confirming the same Flutter framework carried forward even as internal Dart AOT snapshots changed.

Notably, binary growth between Gen 1 and Gen 2 (+48.7%) was confined entirely to private, non-exported Dart AOT code; no new exported entry points appeared.

LevelBlue said in a report shared with GBhackers, analysis focuses on what can be learned directly from ten Mach-O samples across three generations between December 2025 and March 2026: cross-generation binary fingerprints, Dart AOT evolution.

This private-only expansion is consistent with obfuscation metadata growth and the addition of internal command handlers rather than new external interfaces.

FlutterShell Malware Uses C2

Gen 3 marks an operational pivot: certificate rotation to self-signed artifacts and full Dart obfuscation. The obfuscation change increased obfuscated Dart symbols by 669% and redistributed byte content sufficiently to break TLSH fuzzy-hash similarity with earlier generations, degrading fuzzy‑hash–based clustering.

Concurrently, the actor renamed JavaScript bridge commands across generations (exec_sync → pdf_sync → renderPDF) to defeat string‑based detection.

These evasion moves reduced static visibility: Gen 3 artifacts produced no behavioral signals in sandbox telemetry and eluded many prior heuristic signatures that relied on readable Dart symbols, certificate metadata, or visible command strings.

The campaign’s C2‑conditional execution model explains the sandbox gaps. The static binary registers a flutterInvoke JavaScript message channel and loads an attacker-controlled landing page; actual command payloads are JavaScript templates delivered at runtime and are absent from static artifacts.

In reviewed detonation telemetry no flutterInvoke.postMessage activity was observed, and no bridge commands executed because the C2 did not respond.

Consequently, endpoint-level telemetry rather than sandbox outputs offers the highest-fidelity detection surface for live environments.

Practical telemetry to monitor includes WKWebView outbound HTTPS from non‑browser processes to known C2 domains (atsheisdomestic.org, etoftheappyrince.org, healightejustb.org); child processes executing ioreg queries to harvest IOPlatformUUID; non‑Chrome processes writing to Chrome’s Secure Preferences.

Chrome relaunches with crash‑suppression flags combined with a hijack search domain; Sparkle cache replacement activity; and creation of LaunchAgents pointing to suspicious bundle IDs.

Static defenses should additionally leverage the invariant exported-symbol fingerprint and the persistent plugin typo string plugins.flutter.io/path_providerr as durable anchors.

Operationally, the adversary practiced rapid certificate rotation notarized certificates that passed Gatekeeper at distribution, then revoked retroactively and progressed from notarized builds to self-signed artifacts.

That pattern reduced the time window for certificate‑based blocking and forced defenders to rely on structural and runtime signals.

For defenders, a tiered strategy is recommended: Tier A behavioral rules focused on anomalous process and Chrome behavior provide the most robust coverage; Tier B static rules anchored to Flutter runtime artifacts and exported-symbol invariants add generation‑agnostic detection; Tier C addresses remaining network and delivery gaps.

The FlutterShell case underscores how WebView-delivered JavaScript plus a native Dart bridge can enable powerful C2‑conditional malware that is difficult to surface in sandbox-only analyses, making endpoint monitoring and structural binary fingerprints essential for detection.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.