WindShift's WindTail exfiltrates macOS documents
Analysis of macOS malware OSX.WindTail, used by WINDSHIFT APT, reveals installer, self-delete, and document exfiltration logic via curl to C2 servers.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See's second-part analysis of OSX.WindTail dissects the malware's installation, self-deletion, and payload capabilities through reverse engineering and dynamic analysis (lldb, jtool, ProcInfo). The malware, delivered as an app bundle (e.g., Final_Presentation.app), installs itself into the user's ~/Library directory and combines this with a previously documented login-item persistence mechanism. A background thread contacts a C2 server (flux2key.com) and, if instructed, will self-delete and terminate — a remotely triggerable anti-forensic capability.
The core payload logic enumerates the filesystem for documents matching specific extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx), including sensitive files such as TCC.db and IPsec PSK files. Matching files are archived using the built-in zip utility and exfiltrated via curl to a second C2 endpoint (string2me.com) using multipart form uploads. At the time of analysis both C2 servers returned HTTP 403 errors, suggesting the infrastructure was inactive or sinkholed.
The malware is attributed to WINDSHIFT, a APT group associated with a Middle East-focused cyber-espionage operation, per the article and referenced first-part blog post covering exploitation via custom URL schemes. This is a mature macOS espionage tool aimed at silent, persistent exfiltration of documents and credential-relevant files from targeted Macs.
Mentioned in this report
Detection guidance
Suspicious Zip Archive Creation for Document Exfiltration
A behavioural hunt for the technique in general.
Detects zip utility creating archives containing document file extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx) commonly associated with data exfiltration - typical of WindTail-style collection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Zip Archive Creation for Document Exfiltration
description: Detects zip command-line invocations that archive files matching common
document extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx). Malware
like OSX.WindTail uses zip to bundle sensitive files before exfiltration. This rule
generalises on the zip command combined with document file patterns, not specific
archive names or paths.
tags:
- attack.collection
- attack.t1560
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /zip
CommandLine|contains|all:
- .doc
CommandLine|contains:
- .docx
- .ppt
- .pdf
- .xls
- .xlsx
- .db
- .txt
- .rtf
- .pptx
filter_legitimate_backup:
CommandLine|contains:
- Time Machine
- /Library/Caches
- .Trash
condition: selection and not filter_legitimate_backup
falsepositives:
- Legitimate document backup and archival tools
- Users manually archiving project files via command line
level: medium
id: 5d615453-0e14-5720-8444-2b15d79a9646
status: experimental
author: Vorant
Curl Exfiltration of Archived Data via Multipart Form
A behavioural hunt for the technique in general.
Detects curl command-line usage with multipart form data flags (typically -F or --form) targeting remote hosts, consistent with WindTail's exfiltration over C2 channels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Curl Exfiltration of Archived Data via Multipart Form
description: Detects curl command invocations using multipart form upload flags (-F,
--form) to transmit data to remote hosts. OSX.WindTail uses curl with form uploads
to exfiltrate zipped documents to C2 endpoints. This rule generalises on the curl
+ form-upload pattern without requiring specific C2 domains.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1071.001
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /curl
CommandLine|contains:
- ' -F '
- --form
filter_legitimate_uploads:
CommandLine|contains:
- localhost
- 127.0.0.1
- file://
condition: selection and not filter_legitimate_uploads
falsepositives:
- System administration scripts using curl for legitimate API uploads
- Development tools uploading logs or diagnostic data
level: medium
id: 02dee71c-5212-5d36-9081-4a3fad925526
status: experimental
author: Vorant
Suspicious Process Self-Termination with File Deletion
A behavioural hunt for the technique in general.
Detects a process spawning rm or similar file deletion commands targeting its own binary path or parent application bundle, indicative of anti-forensic self-deletion typical of remote-triggered malware cleanup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Self-Termination with File Deletion
description: Detects processes invoking rm, unlink, or similar utilities to delete
files matching their own executable path or parent app bundle directory. OSX.WindTail
implements remotely-triggered self-deletion for anti-forensics. This rule generalises
on the parent-initiated file deletion pattern without requiring specific malware
paths.
tags:
- attack.stealth
- attack.t1070.004
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- /rm
- /unlink
CommandLine|contains:
- /Library
- /Applications
selection_self_reference:
CommandLine|contains:
- -r
- -rf
filter_admin_cleanup:
ParentImage|contains:
- installer
- uninstaller
- Trash
condition: (selection and selection_self_reference) and not filter_admin_cleanup
falsepositives:
- Application uninstallers removing app bundles from /Applications or /Library
- System maintenance scripts cleaning temporary application directories
level: medium
id: 8f7cb548-f6a3-5f3a-b81d-7bba499835f0
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x3D.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs