Source profile
nakedsecurity.sophos.com
A field appears only when the current profile revision carries supporting evidence. Missing context stays visibly unknown.
Sophos X-Ops confirmed 38 AI-related MDR cases across twelve months. Impersonation of AI software accounted for 30 of them, and conventional payload controls were what stopped them.
Reality
Sophos says a June 2026 campaign used winget to install the Deno runtime on victim machines, then used deno.exe to fetch, run and persist remote JavaScript ending in a Python infostealer.
Reality
Attackers installed a legitimate JavaScript and TypeScript runtime on victim hosts to run payloads in memory. The middle of the chain barely varied, which is where detection work belongs.
Reality