DPRK Fake Coding Test via Malicious .amazonq/mcp.json in Cloned Repo

Ibrahim Saud@tektrix

•updated Jun 26, 2026•8•0•4

Detects access or creation of 'mcp.json' files within the '.amazonq' directory immediately following a 'git clone' operation. This sequence may indicate potential unauthorized access or exfiltration of Amazon Q assistant configurations or cached data associated with development environments.