Cursor IDE Spawns Masquerading nohup Renderer Backdoor via Terminal

Ibrahim Saud@tektrix

•updated Sep 21, 2026•11•0•12

Detects the execution of processes named 'nohup' with arguments suggesting renderer masquerading ('--type=renderer') containing suspicious terms like 'SystemUpdate' or 'iSync', originating from Cursor IDE helper processes or the terminal shell. This behavior is indicative of a backdoor or malicious process attempting to hide in plain sight by masquerading as legitimate IDE rendering components.