CVE-2026-12957 Amazon Q MCP AWS Credential Theft via bash and curl

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects instances where common IDE-related processes (like VS Code, Amazon Q, or Node) spawn a shell to execute AWS CLI commands specifically focused on identifying the current caller identity using 'aws sts get-caller-identity' and 'curl'. This pattern often indicates attempts to verify compromised AWS credentials or discover account details from an environment.