GitHub internal repositories breached.

Sophos published multiple May 2026 posts covering active and emergent threats: a malicious VS Code extension reportedly cloned private GitHub internal repositories (assets allegedly offered for sale); WantToCry ransomware performing brute-force attacks against SMB to remotely encrypt files; the AMOS (Atomic macOS Stealer) campaign stealing macOS data at scale; and a Sophos Endpoint investigation describing how anti-exploitation controls blocked a supply‑chain attack. Separately, May’s Patch Tuesday disclosed 132 CVEs (with accompanying advisories), and Sophos also discussed identity security,