WindShift APT abuses macOS URL scheme handlers

WindShift APT used macOS custom URL scheme registration to remotely deploy signed malware against government targets in the Middle East via phishing.

Researcher Patrick Wardle details a remote macOS infection technique used by the WindShift APT group, first disclosed by Taha Karim of DarkMatter at Hack in the Box GSEC. Rather than relying on a traditional vulnerability, the attack abuses legitimate macOS functionality: applications can register custom URL schemes and document handlers in their Info.plist, and macOS automatically registers these handlers with the launch services daemon (lsd) the moment the app touches disk—no user execution required for registration itself. WindShift combined this with spear-phishing to deliver a zip archive that Safari auto-unzips, causing the malicious app's custom URL scheme to be silently registered. JavaScript on an attacker-controlled page then invokes the scheme (e.g., window.location.replace('windshift://')), prompting macOS to launch the malicious, Gatekeeper-signed application.

The technique bypasses Gatekeeper because the malware is code-signed, and older Safari versions (e.g., on El Capitan) show no launch warning at all, while newer versions display a prompt whose displayed "application name" is attacker-controlled and can be obfuscated using homograph/Unicode tricks (e.g., disguising the app as "Attachment.TXT"). The only remaining barrier is the macOS File Quarantine "Allow/Cancel" dialog, which DarkMatter confirmed some targeted government users clicked through. This is a first-stage remote access vector; WindShift is described as a stealthy, hard-to-attribute cyber-espionage actor focused on surveillance of specific individuals rather than broad malware deployment.

Wardle's post is primarily a proof-of-concept reconstruction (no WindShift samples were available to him) illustrating the mechanics and recommending mitigations: disabling Safari's automatic 'open safe files after downloading' option, using browsers other than Safari, and restricting Gatekeeper to Mac App Store apps only. No indicators of compromise from actual WindShift operations are included; the article is technical/defensive in nature.

Source reporting: https://objective-see.org/blog/blog_0x38.html