WindShift's WindTail exfiltrates macOS documents

2 August 2026 routine threat

Analysis of macOS malware OSX.WindTail, used by WINDSHIFT APT, reveals installer, self-delete, and document exfiltration logic via curl to C2 servers.

Objective-See's second-part analysis of OSX.WindTail dissects the malware's installation, self-deletion, and payload capabilities through reverse engineering and dynamic analysis (lldb, jtool, ProcInfo). The malware, delivered as an app bundle (e.g., Final_Presentation.app), installs itself into the user's ~/Library directory and combines this with a previously documented login-item persistence mechanism. A background thread contacts a C2 server (flux2key.com) and, if instructed, will self-delete and terminate — a remotely triggerable anti-forensic capability.

The core payload logic enumerates the filesystem for documents matching specific extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx), including sensitive files such as TCC.db and IPsec PSK files. Matching files are archived using the built-in zip utility and exfiltrated via curl to a second C2 endpoint (string2me.com) using multipart form uploads. At the time of analysis both C2 servers returned HTTP 403 errors, suggesting the infrastructure was inactive or sinkholed.

The malware is attributed to WINDSHIFT, a APT group associated with a Middle East-focused cyber-espionage operation, per the article and referenced first-part blog post covering exploitation via custom URL schemes. This is a mature macOS espionage tool aimed at silent, persistent exfiltration of documents and credential-relevant files from targeted Macs.

Mentioned in this report

Threat actors Windshift

Malware OSX.WindTail

Detection guidance

Suspicious Zip Archive Creation for Document Exfiltration

ATT&CK T1560

Detects zip utility creating archives containing document file extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx) commonly associated with data exfiltration - typical of WindTail-style collection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Zip Archive Creation for Document Exfiltration
description: Detects zip command-line invocations that archive files matching common
  document extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx). Malware
  like OSX.WindTail uses zip to bundle sensitive files before exfiltration. This rule
  generalises on the zip command combined with document file patterns, not specific
  archive names or paths.
tags:
- attack.collection
- attack.t1560
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /zip
    CommandLine|contains|all:
    - .doc
    CommandLine|contains:
    - .docx
    - .ppt
    - .pdf
    - .xls
    - .xlsx
    - .db
    - .txt
    - .rtf
    - .pptx
  filter_legitimate_backup:
    CommandLine|contains:
    - Time Machine
    - /Library/Caches
    - .Trash
  condition: selection and not filter_legitimate_backup
falsepositives:
- Legitimate document backup and archival tools
- Users manually archiving project files via command line
level: medium
id: 5d615453-0e14-5720-8444-2b15d79a9646
status: experimental
author: Vorant

Curl Exfiltration of Archived Data via Multipart Form

ATT&CK T1041

Detects curl command-line usage with multipart form data flags (typically -F or --form) targeting remote hosts, consistent with WindTail's exfiltration over C2 channels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Curl Exfiltration of Archived Data via Multipart Form
description: Detects curl command invocations using multipart form upload flags (-F,
  --form) to transmit data to remote hosts. OSX.WindTail uses curl with form uploads
  to exfiltrate zipped documents to C2 endpoints. This rule generalises on the curl
  + form-upload pattern without requiring specific C2 domains.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1071.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /curl
    CommandLine|contains:
    - ' -F '
    - --form
  filter_legitimate_uploads:
    CommandLine|contains:
    - localhost
    - 127.0.0.1
    - file://
  condition: selection and not filter_legitimate_uploads
falsepositives:
- System administration scripts using curl for legitimate API uploads
- Development tools uploading logs or diagnostic data
level: medium
id: 02dee71c-5212-5d36-9081-4a3fad925526
status: experimental
author: Vorant

Suspicious Process Self-Termination with File Deletion

ATT&CK T1070.004

Detects a process spawning rm or similar file deletion commands targeting its own binary path or parent application bundle, indicative of anti-forensic self-deletion typical of remote-triggered malware cleanup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Process Self-Termination with File Deletion
description: Detects processes invoking rm, unlink, or similar utilities to delete
  files matching their own executable path or parent app bundle directory. OSX.WindTail
  implements remotely-triggered self-deletion for anti-forensics. This rule generalises
  on the parent-initiated file deletion pattern without requiring specific malware
  paths.
tags:
- attack.defense-evasion
- attack.t1070.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - /rm
    - /unlink
    CommandLine|contains:
    - /Library
    - /Applications
  selection_self_reference:
    CommandLine|contains:
    - -r
    - -rf
  filter_admin_cleanup:
    ParentImage|contains:
    - installer
    - uninstaller
    - Trash
  condition: (selection and selection_self_reference) and not filter_admin_cleanup
falsepositives:
- Application uninstallers removing app bundles from /Applications or /Library
- System maintenance scripts cleaning temporary application directories
level: medium
id: 8f7cb548-f6a3-5f3a-b81d-7bba499835f0
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x3D.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free