Skip to content
Threat Feed

Tag

Osx.windtail

1 brief RSS
high threat

WindShift APT Targeting Middle East with OSX.WindTail macOS Implant

The WindShift APT group is targeting Middle Eastern governments with a first-stage macOS implant called OSX.WindTail, abusing custom URL schemes for initial infection and establishing persistence via login items, while decrypting embedded strings to identify file extensions of interest.

OSX.WindTail +2 WindShift macos apt cyber-espionage
2r 1t