WindShift APT abuses macOS URL scheme handlers

2 August 2026 routine threat government-national

WindShift APT used macOS custom URL scheme registration to remotely deploy signed malware against government targets in the Middle East via phishing.

Researcher Patrick Wardle details a remote macOS infection technique used by the WindShift APT group, first disclosed by Taha Karim of DarkMatter at Hack in the Box GSEC. Rather than relying on a traditional vulnerability, the attack abuses legitimate macOS functionality: applications can register custom URL schemes and document handlers in their Info.plist, and macOS automatically registers these handlers with the launch services daemon (lsd) the moment the app touches disk—no user execution required for registration itself. WindShift combined this with spear-phishing to deliver a zip archive that Safari auto-unzips, causing the malicious app's custom URL scheme to be silently registered. JavaScript on an attacker-controlled page then invokes the scheme (e.g., window.location.replace('windshift://')), prompting macOS to launch the malicious, Gatekeeper-signed application.

The technique bypasses Gatekeeper because the malware is code-signed, and older Safari versions (e.g., on El Capitan) show no launch warning at all, while newer versions display a prompt whose displayed "application name" is attacker-controlled and can be obfuscated using homograph/Unicode tricks (e.g., disguising the app as "Attachment.TXT"). The only remaining barrier is the macOS File Quarantine "Allow/Cancel" dialog, which DarkMatter confirmed some targeted government users clicked through. This is a first-stage remote access vector; WindShift is described as a stealthy, hard-to-attribute cyber-espionage actor focused on surveillance of specific individuals rather than broad malware deployment.

Wardle's post is primarily a proof-of-concept reconstruction (no WindShift samples were available to him) illustrating the mechanics and recommending mitigations: disabling Safari's automatic 'open safe files after downloading' option, using browsers other than Safari, and restricting Gatekeeper to Mac App Store apps only. No indicators of compromise from actual WindShift operations are included; the article is technical/defensive in nature.

Mentioned in this report

Threat actors Windshift

Detection guidance

Malicious Application Registered Custom URL Scheme via Info.plist

ATT&CK T1036

Detection of applications registering custom URL schemes through Info.plist CFBundleURLSchemes that are then invoked by remote pages - abuses macOS launch services registration mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Malicious Application Registered Custom URL Scheme via Info.plist
description: Detects applications registering custom URL schemes in Info.plist that
  enable remote invocation via JavaScript (e.g., window.location.replace('customscheme://')),
  characteristic of WindShift APT technique abusing macOS URL handler registration.
tags:
- attack.t1036
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /lsd
    CommandLine|contains:
    - CFBundleURLSchemes
    - CFBundleURLName
  condition: selection
falsepositives:
- Legitimate application installations registering standard URL schemes (http, https,
  ftp handlers)
- System processes during normal application installation
level: medium
id: 0efa996e-3369-50fa-8642-bce48d335230
status: experimental
author: Vorant

Gatekeeper-Signed Malicious App Launched via URL Scheme Invocation

ATT&CK T1204.002

Detection of signed applications being launched via custom URL scheme handler triggered from browser or remote JavaScript, bypassing traditional execution warnings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Gatekeeper-Signed Malicious App Launched via URL Scheme Invocation
description: Detects legitimate-appearing, code-signed applications being launched
  through macOS URL scheme handlers registered in Info.plist, allowing attacker-controlled
  web pages to silently launch malware - technique used by WindShift APT.
tags:
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_url_scheme_launch:
    ParentImage|endswith:
    - /Finder
    - /lsd
    - /launchservicesd
    CommandLine|contains: ://
  selection_signed_binary:
    Image|endswith:
    - .app/Contents/MacOS/*
  condition: selection_url_scheme_launch and selection_signed_binary
falsepositives:
- Legitimate URL scheme handlers (mailto, tel, webcal) invoked during normal user
  browsing
- System applications responding to registered protocol handlers
level: high
id: 814c3d63-017a-5688-b36e-bb0be2f3c874
status: experimental
author: Vorant

Safari Auto-Extract and Malicious App Registration from Downloaded Archive

ATT&CK T1566

Detection of Safari automatically extracting zip archives followed by immediate macOS launch services registration of contained application with custom URL schemes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Safari Auto-Extract and Malicious App Registration from Downloaded Archive
description: Detects Safari auto-extracting zip files from downloads and the contained
  application immediately registering custom URL schemes with macOS launch services
  daemon - characteristic of WindShift phishing delivery chain.
tags:
- attack.t1566
logsource:
  category: process_creation
  product: macos
detection:
  selection_archive_extraction:
    Image|endswith:
    - /Archive Utility
    - /ditto
    CommandLine|contains:
    - .zip
    - -xk
  selection_lsd_registration:
    Image|endswith: /lsd
    CommandLine|contains: CFBundleURLSchemes
  filter_legitimate_downloads:
    CommandLine|contains:
    - /Library/
    - /Applications/
    - com.apple
  condition: (selection_archive_extraction or selection_lsd_registration) and not
    filter_legitimate_downloads
falsepositives:
- Legitimate application installations from downloaded archives registering standard
  handlers
- Software distribution and update tools extracting and installing apps
level: medium
id: b095aaa1-75b1-54d8-be01-b116178978f6
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x38.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free