BeaverTail and InvisibleFerret: recovery after a fake coding assignment.

What was reported

In its September 2026 incident review, Sophos described a fake job-assignment repository opened on an employee's Mac. A modified VS Code terminal profile ran a payload when the integrated terminal opened. Sophos identified BeaverTail followed by the InvisibleFerret backdoor.

The review also found that revoking sessions had left a third-party application authorization active. Sophos later revoked that grant after unauthorized repository reads. Its account of one incident is a useful reason to check application grants separately during recovery. Read Sophos's incident review.

Stop and preserve

Stop using the affected workstation. Ask IT to isolate it and preserve the repository URL, commit, recruiter messages, execution times, and endpoint alerts. Have a responder inspect suspect workspace settings as text in a controlled environment; do not reopen the project in a trusted editor session.

Record whether a terminal, project task, dependency install, or test actually ran. Merely receiving a link and executing a repository are different events; the response needs the best available timeline.

Review account access

• From a clean administrative device, review the source-code account's sign-ins, active sessions, application grants, personal access tokens, and SSH keys. Revoke exposed access and record what was replaced.
• Identify credentials available through the developer's tools, environment, browser, and SSH agent. Include cloud, package registry, and build-system access where applicable.
• Review repository activity, new keys, application approvals, and release changes during the exposure window. Ask other recipients of the same assignment whether they ran it.

Return the device to service

Plan the device recovery with the responder and verify endpoint protection through its management console. An installed application icon does not establish that protection is running or reporting.

Sophos reported no persistence in its particular incident, and a reboot ended that in-memory process. That does not establish that another infected device is safe after rebooting. Preserve evidence first, rebuild when trust cannot be restored, and complete account recovery before resuming development.

For future recruitment exercises, use an isolated environment with no company secrets or authenticated work accounts. Review workspace configuration before allowing project tasks or terminal profiles to run.