CursorJack - Cursor IDE Spawning Download or Staging Utility

Bryant Smith@flowstate

•updated Mar 17, 2026•6•0•111

Detects Cursor IDE spawning download utilities or LOLBins commonly used for payload staging. Directly maps to the CursorJack technique where a malicious MCP deeplink encodes a command that downloads and executes a remote payload. Low false-positive rate — these child processes have no legitimate use when launched directly by Cursor.