Malware

WindTail

WindTail is a macOS malware family associated with cyber-espionage activity in the Middle East. It has been documented as a backdoor-oriented implant for Apple systems that emphasizes stealth, file collection, and data theft. Observed functionality includes decrypting embedded strings with hard-coded AES keys, executing applications without a Dock icon or menu presence to reduce user visibility, generating date and time information, enumerating directories through Apple APIs, selecting files by extension for collection, archiving gathered files with the native macOS zip utility, automatically exfiltrating collected data with the built-in curl utility, and receiving a self-delete command for cleanup. The malware’s behavior is consistent with targeted post-compromise collection and exfiltration on macOS endpoints rather than broad commodity distribution.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.004Unix ShellEvidence1

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.013Encrypted/Encoded FileEvidence1

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

T1027.015CompressionEvidence1

T1070Indicator RemovalEvidence1

Many entries explicitly describe deleting artifacts 'to cover tracks,' 'evade detection,' 'remove evidence,' 'reduce their footprint,' or as part of 'post-intrusion cleanup process.' Examples include APT28 deleting files to cover tracks, FIN5 using SDelete to clean up the environment, and Dragonfly deleting operational files as part of cleanup.

T1070.004File DeletionEvidence7

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1140Deobfuscate/Decode Files or InformationEvidence7

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1564.003Hidden WindowEvidence3

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence6

Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.

T1124System Time DiscoveryEvidence3

The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".

Collection

4 techniques

T1005Data from Local SystemEvidence2

Confucius has used a file stealer to steal documents and images... Patchwork developed a file stealer to search C:\ and collect files with certain extensions... Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

T1119Automated CollectionEvidence2

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

T1560Archive Collected DataEvidence2

APT28 used a publicly available tool to gather and compress multiple documents... LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive... NETWIRE can automatically archive collected data.

T1560.001Archive via UtilityEvidence1

Command and Control

1 technique

T1071.001Web ProtocolsEvidence6

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

ACTIVITY FEED

Recent activity

24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

24 SOURCESView more in app

mitre attack websiteNews

Mar 20, 2026

Hide Artifacts: Hidden Window, Sub-technique T1564.003 - Enterprise | MITRE ATT&CK®

Backdoor malware that launches applications without visible dock icons or menus to reduce visibility.

picus security blogNews

Feb 17, 2022

T1059 Command and Scripting Interpreter of the MITRE ATT&CK Framework

A macOS backdoor used for persistent remote access and control.

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Minor Software changes: ... WindTail

mitre attack websiteNews

Oct 21, 2021

System Time Discovery, Technique T1124 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of generating current date and time values.

+20 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

WindTail