I Backdoored Cursor AI
Source: YouTube · John Hammond · published Apr 8, 2025 · 32:47
Loki C2 is a Node.js-based command and control framework that backdoors Electron applications by replacing their JavaScript files with malicious code, allowing attackers to gain persistent remote access 0:48-0:59.
Key Takeaways:
• Loki exploits Electron’s trust in signed applications by injecting malicious JavaScript files into the app’s runtime, enabling arbitrary code execution 1:25-2:03.
• The framework uses Azure Storage Blobs with SAS tokens for encrypted, proxy-aware command and control, avoiding a central server 2:30-3:35.
• Attackers can backdoor apps like Cursor by replacing the resources folder content, leveraging the app’s lack of security integrity checks (e.g., missing ASR validation) 8:08-11:18.
• A persistent backdoor is achieved via hot-swapping package.json to dynamically switch between legitimate app scripts and Loki’s C2 code, maintaining normal app operation 28:03-31:06.
This demonstrates a powerful, stealthy backdoor technique applicable to any Electron app—such as VS Code, Discord, or Notion—potentially enabling long-term access without user detection.
Sources:
- 0:48 Introduction to Loki C2 and its targeting of Electron apps.
- 1:25-2:03 Explanation of how Electron executes JavaScript and the vulnerability in file loading.
- 2:30-3:35 Details on Loki’s C2 architecture using Azure and SAS tokens.
- 8:08-11:18 Step-by-step demonstration of app vulnerability detection and payload injection.
- 28:03-31:06 Description of the persistent backdoor via package.json hot-swapping.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
The AI code editor cursor is an electronbased app. And what that means is that it uses Node.js to run JavaScript, usually webbased code to render web-based content, but with Electron running locally on your desktop computer. Now, there are tons of different Electron applications. Obviously, Cursor and VS Code, but think Discord and Slack and Zoom and Microsoft Teams and Notion and Obsidian and Signal and GitHub Desktop. There are tons of these software solutions for the modern-day software stack that run on your desktop with Electron, and you probably use these day in and day out. Well, just recently my friend Bobby Cook put together an incredibly cool tool for penetration testing, red teaming, offensive cyber security work, and he built a NodeJSbased command and control framework that bac…