Cybersecurity researchers have identified a macOS malvertising campaign called Operation FlutterBridge that distributes the FlutterShell backdoor through malicious Google and YouTube advertisements. Palo Alto Networks Unit 42 reports this represents an evolution of the JSCoreRunner (FileRipple) attack cluster previously documented in August 2025, indicating an ongoing and adapting threat campaign
Cybersecurity researchers have shed light on a macOS malvertising campaign codenamed Operation FlutterBridge that spreads a new backdoor called FlutterShell. According to Palo Alto Networks Unit 42, the campaign is said to be the next stage of a previously reported activity cluster dubbed JSCoreRunner (aka FileRipple) in late August 2025. The cybercrime group behind the two attack chains is
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
1 min read
1 min read
1 min read