Blog

Insights and research from the Phorion team

Subscribe via RSS

October 30, 2026

Official Claude Code Extension Compromise: Security Advisory

Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence.

Organisations should immediately review their environments for use of Claude Code for VSCode 2.1.313 and engage incident response where use of the extension is discovered.

SSH Backdoor Cursor Marketplace VS Code macOS Linux Windows Threat Report

October 20, 2026

Endpoint Security in the AI Age, Part II: Detection and Triage

This post looks at how agent attribution, collected session prompts and script content help analysts investigate AI-driven activity. We also cover tuning detections around common agent behaviour and scoping exclusions to the devices where that activity is expected.

AI macOS Detection Engineering Incident Response

October 12, 2026

Endpoint Security in the AI Age, Part I: Rethinking Detection Fidelity

AI is blurring the line between what users deliberately do and what software does on their behalf. As familiar patterns give way to unpredictable workflows, how do security teams tell normal activity from something worth investigating?

AI macOS Detection Engineering

September 30, 2026

Phorion achieves SOC 2 Type II compliance

Phorion has completed a SOC 2 Type II audit conducted by Insight Assurance. The report gives customers independent assurance over how we secure the infrastructure, access, and data behind our macOS EDR platform.

Compliance SOC 2 Security Company News

Detecting and Preventing npm Supply Chain Attacks with Phorion Protections

Tracking an npm package install through each stage of its lifecycle allows for precise, context-aware protections that safeguard credentials, block second-stage payload execution, and prevent worm propagation.

Protections npm Supply Chain File Access Controls Research

Beyond Detection: Proactive Process and File Controls for macOS

Phorion Protections brings file access authorization, process execution controls, and EDR telemetry into a single macOS endpoint security solution. Layered defences, scoped to your environment, with the analytics to deploy them confidently.

EDR Protections Feature Release macOS Endpoint Hardening File Access Controls

Introducing Clipboard Protection: Stopping ClickFix Attacks on macOS

ClickFix-style paste attacks are one of the most effective social engineering techniques targeting macOS. Today we’re releasing Clipboard Monitoring, a fully configurable capability that detects and blocks malicious pastes in real time.

Clipboard Protection ClickFix Pastejacking Feature Release

#1 in the EDR Telemetry Project: The Visibility Advantage

Phorion ranked #1 in the EDR Telemetry Project, scoring more than twice the points of the next closest vendor. This post breaks down our approach to visibility and the critical detection coverage it enables.

EDR Telemetry macOS

Reverse Engineering macOS 26.4's Undocumented Socket Bind Events

Apple’s macOS 26.4 introduced several undocumented Endpoint Security events. We reverse engineered ES_EVENT_TYPE_RESERVED_3 and _4 to reveal new socket bind visibility for security tools.

ESF Endpoint Security Framework macOS Internals Research

November 27, 2025

macOS Paradox Stealer used in Solidity Open VSX Extension Attack

Threat actors used a malicious Cursor extension to push Paradox Stealer into developer workflows. The blog traces the attack step by step and highlights the detections that prevented data theft.

Cursor Open VSX Paradox Stealer SleepyDuck Infostealer Threat Report

Let's Talk

See how Phorion protects your macOS fleet

Purpose-built by macOS security researchers. One lightweight agent delivering detection, prevention, and visibility.

Ready to see it in action? Book a demo and we'll show you how Phorion can protect your fleet.

Book a Demo

Expect a personal email from our team.