Phorion | macOS Endpoint Detection and Response (EDR)

Official Claude Code Extension Compromise: Security Advisory

Fri, 30 Oct 2026 00:00:00 +0000

Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence.

Organisations should immediately review their environments for use of Claude Code for VSCode 2.1.312 or 2.1.313 and engage incident response where use of the extension is discovered.

Endpoint Security in the AI Age, Part II: Detection and Triage

Tue, 20 Oct 2026 00:00:00 +0000

This post looks at how agent attribution, collected session prompts and script content help analysts investigate AI-driven activity. We also cover tuning detections around common agent behaviour and scoping exclusions to the devices where that activity is expected.

Endpoint Security in the AI Age, Part I: Rethinking Detection Fidelity

Mon, 12 Oct 2026 00:00:00 +0000

AI is blurring the line between what users deliberately do and what software does on their behalf. As familiar patterns give way to unpredictable workflows, how do security teams tell normal activity from something worth investigating?

Phorion achieves SOC 2 Type II compliance

Wed, 30 Sep 2026 00:00:00 +0000

Phorion has completed a SOC 2 Type II audit conducted by Insight Assurance. The report gives customers independent assurance over how we secure the infrastructure, access, and data behind our macOS EDR platform.

Detecting and Preventing npm Supply Chain Attacks with Phorion Protections

Thu, 21 May 2026 09:00:00 +0000

Tracking an npm package install through each stage of its lifecycle allows for precise, context-aware protections that safeguard credentials, block second-stage payload execution, and prevent worm propagation.

Beyond Detection: Proactive Process and File Controls for macOS

Mon, 18 May 2026 00:30:00 +0000

Phorion Protections brings file access authorization, process execution controls, and EDR telemetry into a single macOS endpoint security solution. Layered defences, scoped to your environment, with the analytics to deploy them confidently.

Introducing Clipboard Protection: Stopping ClickFix Attacks on macOS

Thu, 02 Apr 2026 09:00:00 +0000

ClickFix-style paste attacks are one of the most effective social engineering techniques targeting macOS. Today we’re releasing Clipboard Monitoring, a fully configurable capability that detects and blocks malicious pastes in real time.

#1 in the EDR Telemetry Project: The Visibility Advantage

Mon, 30 Mar 2026 00:30:00 +0000

Phorion ranked #1 in the EDR Telemetry Project, scoring more than twice the points of the next closest vendor. This post breaks down our approach to visibility and the critical detection coverage it enables.

Reverse Engineering macOS 26.4's Undocumented Socket Bind Events

Fri, 27 Mar 2026 19:30:00 +0000

Apple’s macOS 26.4 introduced several undocumented Endpoint Security events. We reverse engineered ES_EVENT_TYPE_RESERVED_3 and _4 to reveal new socket bind visibility for security tools.

macOS Paradox Stealer used in Solidity Open VSX Extension Attack

Thu, 27 Nov 2025 09:30:00 +0000

Threat actors used a malicious Cursor extension to push Paradox Stealer into developer workflows. The blog traces the attack step by step and highlights the detections that prevented data theft.