AWS Credential Exfiltration via MCP Spawned Process Environment Inheritance

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•8

Detects instances where language-related processes (amazonq-language-server, node) or common tools (bash, sh, curl, aws) execute commands containing AWS access credentials or perform potential data exfiltration via curl POST requests.