Personalized Federated Learning (PFL) is an emerging solution for distributed learning in heterogeneous data environments. Unlike traditional FL, PFL is considered more robust against backdoor attacks due to two inherent properties: (P1) Heterogeneous data distribution mitigates the impact of poisoned neurons during aggregation, and (P2) Locally personalized fine-tuning further modifies poisoned neurons to fit local data distributions, disrupting the linkage between the trigger and attack target. However, we reveal that attackers can exploit deeper insights to bypass these properties and propose a new attack method called BadPFL. For P1, BadPFL reduces the trigger’s dependence on poisoned neurons by integrating target semantic information directly into it, ensuring that even benign models can naturally associate the trigger with the target class, thus enabling the backdoor to survive during aggregation. For P2, we enhance the attack’s persistence by integrating more robust target features, making it more resistant to modifications introduced by local fine-tuning. Extensive experiments on three benchmark datasets demonstrate that BadPFL remains highly effective against various PFL methods, even in the presence of advanced defense strategies.