The term "backdoor" kind of has two commonly used but somewhat different meanings: an embedded backdoor and an access backdoor. (Or perhaps "application backdoo

The term "backdoor" kind of has two commonly used but somewhat different meanings: an embedded backdoor and an access backdoor. (Or perhaps "application backdoor" vs. "system backdoor".) The first meaning is what you describe: something malicious stealthily implanted into an otherwise-legitimate or thought-to-be-legitimate application or appliance. The other meaning covers any method of secret access persistence on a compromised system (generally a host, like a server). This could be something like a bash script that launches a reverse shell when you login, a malicious kernel module that extracts and executes arbitrary C code if a specific pattern is detected in network traffic, or just about anything imaginable. And you could also achieve it with the former definition. I think among the infosec community, it's indeed more common for "backdoor" to refer to the former and a general term like "persistence" / "persistence mechanism" (though that can potentially refer to anything malicious that persists), or sub-categories like "foothold", to refer to the latter. "Backdoor" for the latter wouldn't be a misuse, though. There's also a possible looser third definition, where lazy / fearmongering anti-virus companies sometimes like to label almost any kind of malware a "backdoor" or "backdoor trojan", perhaps because that carries more frightening implications for end users than a term like "virus" or "malware". It somewhat overlaps with the second definition, but I think it's rare a technical person would use it that way; it's less rare that a technical person might use the second definition.