FlutterShell Delayed First Contact then Shell Execution

Daniel Jeremiah@daniyyell

•updated Jun 14, 2026•0•0•6

This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.