Threat Brief — 2026-08-16 — Supply-Chain Worm & Interactive macOS Stealer

A self-propagating npm worm has infected 444 packages across a combined 2 billion monthly downloads, leaving no trace in the repository — a serious supply-chain event. Meanwhile, a new macOS infostealer dubbed AmnesiaStealer adds interactive remote browser control, and Threema's secure messaging platform suffered sustained DDoS disruptions.

Top items

• Shai-Hulud npm worm — 444 packages infected, 2B monthly downloads at risk. A self-spreading worm has compromised hundreds of npm packages spanning roughly 2 billion monthly downloads, with no visible trace left in the repository itself. The scale and stealth make this one of the most significant supply-chain compromises of the npm ecosystem to date. (src: SecurityLab)

• AmnesiaStealer macOS malware adds interactive browser remote control. Distributed via ClickFix social-engineering attacks, this new infostealer includes a streaming module that lets attackers interactively control a victim's browser session — going beyond passive credential theft to live session hijacking. macOS fleets using Chrome or Safari are in scope. (src: BleepingComputer)

• Sustained DDoS attacks disrupt Threema secure messaging. Multiple large-scale DDoS campaigns took down Threema earlier this week, causing severe communication outages for users relying on the encrypted messaging platform. The attacks highlight that end-to-end encryption offers no protection against availability threats. (src: BleepingComputer)

• Russia issues fine for searching banned music via VPN. Russian police fined an individual for a simple track search conducted over VPN, confirming the material was on the federal list of extremist materials. This signals continued enforcement of content restrictions even when accessed through privacy tools. (src: SecurityLab)

• Microsoft Teams iOS CVE-2026-65769 — informational build-number correction only. MSRC updated the corrected build number for an existing information-disclosure advisory. No new vulnerability or exploit; this is a documentation change. (src: MSRC)

Themes

Supply-chain and client-side threats dominate. Both the npm worm and AmnesiaStealer target trust at different layers — package repositories and user-side social engineering respectively. The npm worm's repository stealth is particularly concerning for CI/CD pipelines that auto-resolve dependencies. Recommend immediate npm audit and lockfile review, plus heightened awareness of ClickFix-style fake verification prompts on macOS endpoints.

===