FLATROOF/ROOFDECK C2 Beaconing Gated on Cursor IDE Session

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

Detects network beaconing activity from suspicious processes that masquerade as macOS system services, specifically filtered to only trigger when an active Cursor IDE session is detected on the host. This behavior correlates network-based C2 activity with an active development environment, potentially indicating an adversary using legitimate IDE sessions to blend in or exfiltrate development-related data.