BeepRAT/CVE-2026-12957 MCP AWS credential theft via aws sts get-caller-identity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects suspicious subprocesses spawned by IDE or extension host processes (like VS Code or Amazon Q) that execute AWS CLI commands to enumerate identity or immediately exfiltrate data via curl/wget, indicating potential credential abuse by malicious plugins or MCP servers.