Getting rid of Mughthesec and Adloadr

I have Sophos Home installed. At the moment, once or twice a day it finds the 'potentially unwanted applications' Mughthesec and Adloadr.

They are always within a directory within /private/tmp/ (and within that within nested directories with long alphanumeric names).

Sophos enables me to clean these up each time – but I don't know why they keep appearing. I'm assuming there is a root cause I haven't identified. Any ideas?