Macfinger ClickFix campaign targets macOS users via injected scripts

🕵️ RESEARCH & DEEP DIVES

• Macfinger ClickFix campaign targets macOS users via injected scripts on legitimate websites
  A new ClickFix campaign dubbed Macfinger is infecting macOS users with an AMOS Stealer variant through malicious scripts injected into legitimate websites.
  • Targets macOS users; legitimate websites were found with injected script serving fake bot-protection pages.
  • Injected script shows fake verification pop-ups with ClickFix instructions tricking users into running commands.
  • Victim hosts send POST requests to the Macfinger domain (velvet-otter-glagceis[.]life) reporting user info and tracking actions.
  • Malware is fetched from 45.150.33[.]128 as a shell script, then arm64/x86_64 Mach-O payloads; C2 traffic goes to 95.163.153[.]80:8133 with /api/credentials exfiltration.
  • Ransom-ISAC identifies the final payload as a variant of Atomic macOS (AMOS) Stealer; indicators differ from previously reported AMOS activity.
  Sources 📄 Source: ransom-isac.org · 📎 Coverage: isc.sans.edu · 👁 via SANS ISC

🔓 CVEs & KEV

• CVE-2026-94367 — OpenEye Apex Network Video Recorder (NVR) — CVSS 7.2 — OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS c...

• CVE-2026-92928 — OpenEye Apex Network Video Recorder (NVR) — CVSS 6.5 — OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardc...

• CVE-2026-92930 — OpenEye Apex Network Video Recorder (NVR) — CVSS 6.2 — OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administ...