Sophos published root-cause analysis INC-2026-002 on 20 October 2026 (and a 4 November 2026 Insights post by CISO Ross McKerchar) about a September 2026 compromise of one employee's corporate macOS device.

According to Sophos, on 14 September 2026 the employee cloned a public repository presented as a job-interview coding assignment and opened it as a Visual Studio Code workspace; weaponized workspace settings replaced the integrated terminal profile and, when a terminal opened, silently downloaded and ran a multi-stage payload that SophosLabs identified as the BeaverTail loader followed by the InvisibleFerret backdoor (an in-memory RAT able to steal browser-stored credentials, keychain data, SSH keys and cryptocurrency-wallet data).

Sophos says the Sophos Endpoint agent was installed but not functional (core services not running; last seen in Sophos Central on 11 June 2026), and that a working agent would have blocked the first dropped file. An industry partner tipped Sophos on 15 September; containment the same day revoked corporate sessions, reset the password and moved the device to a non-compliant group; the in-memory implant ended on reboot with no persistence found; an estate sweep found no other affected hosts.

Sophos says impact was limited to that one internal Mac and user account: no Sophos products, services, customers, customer data or customer-facing systems were affected; residual exposure was assessed as the user's ssh-agent session (personal SSH keys only, revoked); and on 15 September a third-party OAuth authorization on the user's source-code platform account made 27 read requests against two internal Sophos repositories from an unfamiliar address before revocation on 16 September. (source: Sophos INC-2026-002 RCA; Sophos Insights 4 Nov 2026)