What happens when a fake coding test reaches a security company?

Sophos says a fake GitHub coding assignment compromised one employee's Mac in September, when a hidden VS Code workspace command installed the BeaverTail and InvisibleFerret malware within two minutes. A partner's tip revealed it, because the Mac's endpoint agent was broken. Sophos links the technique to North Korean groups and to Binance's reported $6.3 billion theft, though the Binance details, the detection claim and the advisory figures could not be independently checked. Its advice: reconcile identity sign-ins against endpoint telemetry, and limit what AI tools can reach.