# WindShift's WindTail exfiltrates macOS documents

Published: 2026-08-02 · Severity: medium
Canonical: https://vorant.io/reports/302243a1-cf92-5e8c-9e4e-6a0e3738ea3b/windshift-s-windtail-exfiltrates-macos-documents

> Analysis of macOS malware OSX.WindTail, used by WINDSHIFT APT, reveals installer, self-delete, and document exfiltration logic via curl to C2 servers.

Objective-See's second-part analysis of OSX.WindTail dissects the malware's installation, self-deletion, and payload capabilities through reverse engineering and dynamic analysis (lldb, jtool, ProcInfo). The malware, delivered as an app bundle (e.g., Final_Presentation.app), installs itself into the user's ~/Library directory and combines this with a previously documented login-item persistence mechanism. A background thread contacts a C2 server (flux2key.com) and, if instructed, will self-delete and terminate — a remotely triggerable anti-forensic capability.

The core payload logic enumerates the filesystem for documents matching specific extensions (doc, docx, ppt, pdf, xls, xlsx, db, txt, rtf, pptx), including sensitive files such as TCC.db and IPsec PSK files. Matching files are archived using the built-in zip utility and exfiltrated via curl to a second C2 endpoint (string2me.com) using multipart form uploads. At the time of analysis both C2 servers returned HTTP 403 errors, suggesting the infrastructure was inactive or sinkholed.

The malware is attributed to WINDSHIFT, a APT group associated with a Middle East-focused cyber-espionage operation, per the article and referenced first-part blog post covering exploitation via custom URL schemes. This is a mature macOS espionage tool aimed at silent, persistent exfiltration of documents and credential-relevant files from targeted Macs.

## Mentioned in this report

- Threat actors: Windshift
- Malware: OSX.WindTail

Source reporting: https://objective-see.org/blog/blog_0x3D.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/302243a1-cf92-5e8c-9e4e-6a0e3738ea3b/windshift-s-windtail-exfiltrates-macos-documents.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup