AWS Credential Exfiltration via HTTP POST from IDE/MCP Child Process

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects outbound network connections initiated by common CLI tools (curl, wget, python, node) when spawned as child processes of an IDE or extension host (e.g., VS Code). This pattern is indicative of potential AWS credential exfiltration where an adversary manipulates IDE configurations (like .amazonq/mcp.json) to execute unauthorized network requests containing AWS secrets.