Phorion (macOS EDR vendor research blog)

phorion · B · candidate

researchlang: enfetch failures: 0quiet periods: 0last fetch: never

Added 2026-10-31 (2026-10-31T0256Z-intel, S3): discovered the trojanised Claude Code extension in the Cursor marketplace and published the first technical analysis, with macOS endpoint tradecraft that Microsoft Threat Intelligence then confirmed independently. No feed found (two probed paths 404); `fetch_source.py extract` of an article URL read cleanly, the listing path is unverified. Candidate: promote after three contributing runs.

Cited in 1 entry

Citation cadence

Citation days per ISO week (1 weeks of coverage span, total 1).

Cursor marketplace: a tampered Claude Code extension (versions 2.1.312 and 2.1.313) planted an SSH key, a reverse tunnel and persistence for about eleven hours on 2026-10-29; uninstalling it does not remove the persistence2026-10-31