Cursor IDE Launching Dormant FLATROOF/ROOFDECK Backdoors on Workspace Open

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

Detects the Cursor IDE application launching specific macOS system binaries ('SystemUpdate', 'iSync', 'loginwindow') that are potentially being used to execute hidden backdoors, often associated with the 'FLATROOF' or 'ROOFDECK' threats. The rule looks for process spawning behavior where Cursor initiates these binaries with specific suspicious command-line flags ('nohup', '--type=renderer') or in directories associated with known malicious activity.