Skip to content
Threat Feed

Actor

WINDSHIFT APT

1 brief RSS
high threat

WINDSHIFT APT Abuses Custom URL Schemes for macOS Infection

The WINDSHIFT APT group is infecting Macs by abusing custom URL schemes, where advertising support for a custom URL scheme in an application's Info.plist causes the application to be automatically launched when a URL with that scheme is opened, allowing attackers to remotely compromise systems with minimal user interaction and creating an initial access vector.

macOS WINDSHIFT APT url-scheme apt
2r 1t