WindShift APT abuses macOS URL scheme handlers
WindShift APT used macOS custom URL scheme registration to remotely deploy signed malware against government targets in the Middle East via phishing.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Researcher Patrick Wardle details a remote macOS infection technique used by the WindShift APT group, first disclosed by Taha Karim of DarkMatter at Hack in the Box GSEC. Rather than relying on a traditional vulnerability, the attack abuses legitimate macOS functionality: applications can register custom URL schemes and document handlers in their Info.plist, and macOS automatically registers these handlers with the launch services daemon (lsd) the moment the app touches disk—no user execution required for registration itself. WindShift combined this with spear-phishing to deliver a zip archive that Safari auto-unzips, causing the malicious app's custom URL scheme to be silently registered. JavaScript on an attacker-controlled page then invokes the scheme (e.g., window.location.replace('windshift://')), prompting macOS to launch the malicious, Gatekeeper-signed application.
The technique bypasses Gatekeeper because the malware is code-signed, and older Safari versions (e.g., on El Capitan) show no launch warning at all, while newer versions display a prompt whose displayed "application name" is attacker-controlled and can be obfuscated using homograph/Unicode tricks (e.g., disguising the app as "Attachment.TXT"). The only remaining barrier is the macOS File Quarantine "Allow/Cancel" dialog, which DarkMatter confirmed some targeted government users clicked through. This is a first-stage remote access vector; WindShift is described as a stealthy, hard-to-attribute cyber-espionage actor focused on surveillance of specific individuals rather than broad malware deployment.
Wardle's post is primarily a proof-of-concept reconstruction (no WindShift samples were available to him) illustrating the mechanics and recommending mitigations: disabling Safari's automatic 'open safe files after downloading' option, using browsers other than Safari, and restricting Gatekeeper to Mac App Store apps only. No indicators of compromise from actual WindShift operations are included; the article is technical/defensive in nature.
Mentioned in this report
Detection guidance
Malicious Application Registered Custom URL Scheme via Info.plist
A behavioural hunt for the technique in general.
Detection of applications registering custom URL schemes through Info.plist CFBundleURLSchemes that are then invoked by remote pages - abuses macOS launch services registration mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malicious Application Registered Custom URL Scheme via Info.plist
description: Detects applications registering custom URL schemes in Info.plist that
enable remote invocation via JavaScript (e.g., window.location.replace('customscheme://')),
characteristic of WindShift APT technique abusing macOS URL handler registration.
tags:
- attack.t1036
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /lsd
CommandLine|contains:
- CFBundleURLSchemes
- CFBundleURLName
condition: selection
falsepositives:
- Legitimate application installations registering standard URL schemes (http, https,
ftp handlers)
- System processes during normal application installation
level: medium
id: 0efa996e-3369-50fa-8642-bce48d335230
status: experimental
author: Vorant
Gatekeeper-Signed Malicious App Launched via URL Scheme Invocation
A behavioural hunt for the technique in general.
Detection of signed applications being launched via custom URL scheme handler triggered from browser or remote JavaScript, bypassing traditional execution warnings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Gatekeeper-Signed Malicious App Launched via URL Scheme Invocation
description: Detects legitimate-appearing, code-signed applications being launched
through macOS URL scheme handlers registered in Info.plist, allowing attacker-controlled
web pages to silently launch malware - technique used by WindShift APT.
tags:
- attack.t1204.002
logsource:
category: process_creation
product: macos
detection:
selection_url_scheme_launch:
ParentImage|endswith:
- /Finder
- /lsd
- /launchservicesd
CommandLine|contains: ://
selection_signed_binary:
Image|endswith:
- .app/Contents/MacOS/*
condition: selection_url_scheme_launch and selection_signed_binary
falsepositives:
- Legitimate URL scheme handlers (mailto, tel, webcal) invoked during normal user
browsing
- System applications responding to registered protocol handlers
level: high
id: 814c3d63-017a-5688-b36e-bb0be2f3c874
status: experimental
author: Vorant
Safari Auto-Extract and Malicious App Registration from Downloaded Archive
A behavioural hunt for the technique in general.
Detection of Safari automatically extracting zip archives followed by immediate macOS launch services registration of contained application with custom URL schemes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Safari Auto-Extract and Malicious App Registration from Downloaded Archive
description: Detects Safari auto-extracting zip files from downloads and the contained
application immediately registering custom URL schemes with macOS launch services
daemon - characteristic of WindShift phishing delivery chain.
tags:
- attack.t1566
logsource:
category: process_creation
product: macos
detection:
selection_archive_extraction:
Image|endswith:
- /Archive Utility
- /ditto
CommandLine|contains:
- .zip
- -xk
selection_lsd_registration:
Image|endswith: /lsd
CommandLine|contains: CFBundleURLSchemes
filter_legitimate_downloads:
CommandLine|contains:
- /Library/
- /Applications/
- com.apple
condition: (selection_archive_extraction or selection_lsd_registration) and not
filter_legitimate_downloads
falsepositives:
- Legitimate application installations from downloaded archives registering standard
handlers
- Software distribution and update tools extracting and installing apps
level: medium
id: b095aaa1-75b1-54d8-be01-b116178978f6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x38.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs