Blog

Insights and research from the Phorion team

Subscribe via RSS

Introducing Clipboard Protection: Stopping ClickFix Attacks on macOS

ClickFix-style paste attacks are one of the most effective social engineering techniques targeting macOS. Today we’re releasing Clipboard Monitoring, a fully configurable capability that detects and blocks malicious pastes in real time.

Clipboard Protection ClickFix Pastejacking Feature Release

#1 in the EDR Telemetry Project: The Visibility Advantage

Phorion ranked #1 in the EDR Telemetry Project, scoring more than twice the points of the next closest vendor. This post breaks down our approach to visibility and the critical detection coverage it enables.

EDR Telemetry macOS

Reverse Engineering macOS 26.4's Undocumented Socket Bind Events

Apple’s macOS 26.4 introduced several undocumented Endpoint Security events. We reverse engineered ES_EVENT_TYPE_RESERVED_3 and _4 to reveal new socket bind visibility for security tools.

ESF Endpoint Security Framework macOS Internals Research

November 27, 2025

macOS Paradox Stealer used in Solidity Open VSX Extension Attack

Threat actors used a malicious Cursor extension to push Paradox Stealer into developer workflows. The blog traces the attack step by step and highlights the detections that prevented data theft.

Cursor Open VSX Paradox Stealer SleepyDuck Infostealer Threat Report

Let's Talk

See how Phorion protects your macOS fleet

Purpose-built by macOS security researchers. One lightweight agent delivering detection, prevention, and visibility.

Ready to see it in action? Book a demo and we'll show you how Phorion can protect your fleet.

Book a Demo

Expect a personal email from our team.