Cursor IDE Suspicious Child Process

Tim Peck@timpeck

•updated Mar 17, 2026•6•1•94

Detects the Cursor IDE process spawning shell interpreters or network utilities. This behavior is associated with the CursorJack technique, where a malicious Model Context Protocol (MCP) server configuration executes commands for initial access or payload staging.