AWS STS GetCallerIdentity Called from VS Code or Amazon Q Extension Host

Ethan Andrews@eandrews

•updated Jun 26, 2026•2•0•6

Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).