BeepRAT/CVE-2026-12957 MCP-Triggered IAM Enumeration from VS Code Subprocess

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of cloud CLI tools (aws, curl) or shell interpreters (bash, sh, cmd, powershell) triggered by development-related processes like Node.js, VS Code, or Amazon Q. This pattern is indicative of potential command-and-control activity or credentials theft occurring via compromised developer environments.