WindShift APT's macOS backdoor OSX.WindTail exposed

2 August 2026 routine threat government-nationalinfrastructure

Objective-See publicly released and analyzed samples of OSX.WindTail, the macOS backdoor used by WindShift APT against Middle Eastern government targets.

Building on prior research by Taha Karim (DarkMatter) presented at Hack in the Box Singapore, Objective-See researchers located and publicly shared four previously-unreleased samples of OSX.WindTail on VirusTotal, confirming them as variants of the WindShift APT group's macOS implant. The malware masquerades as Microsoft Office documents, uses revoked Apple developer certificates, and abuses the LSSharedFileListInsertItemURL API to persist as a login item. Notably, three of the four samples were undetected by any anti-virus engine on VirusTotal at time of writing, despite Apple having revoked the signing certificates - suggesting a gap in threat-intel sharing between Apple and the AV community.

Technical analysis revealed the implant decrypts strings and C2 configuration using a hardcoded AES key identical to one previously shown in Karim's research, strongly tying the new samples to WindShift. Decrypted strings reference file extensions of espionage interest (doc, pdf, db) and two C2 domains, flux2key.com and string2me.com, both previously identified by Karim as WindShift infrastructure. At the time of analysis both domains were offline, limiting dynamic observation of C2 command execution, but static analysis suggests standard backdoor capabilities including file exfiltration and remote command execution.

WindShift is described as a highly-targeted cyber-espionage group focused on individuals in government departments and critical infrastructure organizations in the Middle East. The blog notes that Objective-See's free tools (BlockBlock, KnockKnock) can heuristically detect this malware absent signature-based AV coverage, and provides manual indicators (suspicious Login Items, Office-icon apps with invalid signatures in ~/Library/) for self-triage.

Mentioned in this report

Threat actors Windshift

Malware OSX.WindTailOSX.WindTape

Detection guidance

macOS Login Item Creation via LSSharedFileListInsertItemURL

ATT&CK T1547.011

Detects suspicious processes invoking LSSharedFileListInsertItemURL API to register persistence as a login item - typical for macOS backdoors establishing boot-time execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Login Item Creation via LSSharedFileListInsertItemURL
description: Detects processes calling LSSharedFileListInsertItemURL API to insert
  login items, a technique used by macOS backdoors to establish persistence across
  reboots. Generalises on the distinctive API call pattern rather than specific application
  names or paths.
tags:
- attack.persistence
- attack.t1547.011
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains: LSSharedFileListInsertItemURL
  filter_legitimate:
    Image|contains:
    - /Library/Frameworks/
    - /System/Library/
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate system utilities or installers registering login items via the API
- Third-party security software managing login items programmatically
level: medium
id: 7849faf0-c3c1-5f41-93d0-da6919d15ace
status: experimental
author: Vorant

Suspicious Application Masquerading as Microsoft Office Document

ATT&CK T1036.005

Detects executable files with Office document icons or naming schemes (.doc, .pdf, .xls) containing mach-o binaries - masquerading technique to deceive users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Application Masquerading as Microsoft Office Document
description: Detects executables or bundles disguised with Microsoft Office document
  names or icons (e.g., app bundles with .doc/.docx/.xls in the name containing mach-o
  binaries). Attackers use this to trick users into launching malware disguised as
  benign documents.
tags:
- attack.defense-evasion
- attack.t1036.005
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - .doc
    - .docx
    - .xls
    - .xlsx
    - .pdf
    CommandLine|contains|all:
    - /Contents/MacOS/
  filter_legitimate:
    ParentImage|contains:
    - /Applications/Microsoft Office/
    - /Applications/LibreOffice/
  condition: selection and not filter_legitimate
falsepositives:
- Custom document conversion utilities with misleading naming
- Development or testing scenarios involving document-named bundles
level: high
id: 4b264c8b-9a92-5158-a4d7-8ecb8fc85f65
status: experimental
author: Vorant

AES Decryption of Embedded Strings in Suspicious macOS Binary

ATT&CK T1140

Detects processes performing in-memory AES decryption of embedded configuration or C2 strings - obfuscation technique used to hide backdoor capabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: AES Decryption of Embedded Strings in Suspicious macOS Binary
description: Detects processes executing AES decryption routines (via CommonCrypto
  or similar) to deobfuscate embedded strings, a common technique for hiding C2 configuration
  or command payloads. Generalises on the presence of AES decryption operations paired
  with low-signal process attributes.
tags:
- attack.defense-evasion
- attack.t1140
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - CCCrypt
    - kCCAlgorithmAES
    - kCCAlgorithmAES128
    Image|endswith:
    - .app/Contents/MacOS/*
  filter_signed:
    SignatureStatus: valid
  condition: selection and not filter_signed
falsepositives:
- Legitimate applications using AES encryption for configuration management
- Properly signed security or VPN software decrypting local settings
level: medium
id: d10e4693-6b9b-592f-9705-c46513b3aeec
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x3B.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free