H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[WindTail](https://attack.mitre.org/software/S0466) is a macOS surveillance implant used by [Windshift](https://attack.mitre.org/groups/G0112). [WindTail](https://attack.mitre.org/software/S0466) shares code similarities with Hack Back aka KitM OSX.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)

Labels

malware

16 recorded

Relationships

uses

Group

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hidden Window

Technique

uses

to Invalid Code Signature

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to System Time Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

4 external

References

mitre-attack

S0466

SANS Windshift August 2018

https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868

objective-see windtail1 dec 2018

https://objective-see.com/blog/blog_0x3B.html

objective-see windtail2 jan 2019

https://objective-see.com/blog/blog_0x3D.html