Chrome Secure Preferences Modified (FlutterShell)

Ethan Andrews@eandrews

•updated Jun 2, 2026•1•0•5

This rule detects modifications, creations, or renames of the Google Chrome 'Secure Preferences' file on macOS. This activity can be indicative of malware, such as FlutterShell, attempting to alter browser settings or inject malicious configurations for persistence or other malicious purposes.