What Happens When a Fake Coding Test Reaches a Security Company?
Sophos, Wednesday, November 4th, 2026
Sophos describes how a fake coding test compromised an employee's Mac, linking the tactic to North Korean groups and the Binance theft.
Sophos notes that fake job interviews are an established way to target developers, whose machines often reach source code and production systems, and that Binance's $6.3 billion theft, attributed by the FBI to North Korea, began this way.
In September an industry partner alerted Sophos that an employee's Mac had been compromised after opening a GitHub coding assignment in VS Code.
A command hidden in workspace settings ran when a terminal opened, and within two minutes the BeaverTail loader and InvisibleFerret backdoor were running.
Sophos says its controls failed because the Mac's endpoint agent was broken, though its protection already detected the payload, and it published root cause analysis INC-2026-002.