WindTape

WindTape is a piece of Mac malware used by the WindShift APT group. This malware, in particular, serves a relatively simple but important purpose – it grabs screenshots of the victim's desktop every five seconds, sends the image to the attacker's server and then deletes the original. This threat is likely to be used in WindShift's signature surveillance campaigns that focus on monitoring conversations and gaining access to data. If WindShift's target is negligent when it comes to cybersecurity, it is possible that WindTape also may grab screenshots of login credentials and other data.

The first detected samples of WindTape date back to January 2018, and this malware has not been used much since then. One of the motivations for this is because the hackers from WindShift rely on their hacking tools as a last resort – they usually try to achieve their goals by focusing on complicated social engineering schemes.

While WindTape's features are not spectacular, the fact that it is able to infiltrate macOS (OSX) devices is a huge game-changer – only a handful of APT actors have the resources and knowledge to craft malware that targets Apple computers and laptops.