BeepRAT/CVE-2026-12957 MCP AWS Credential Theft via aws sts get-caller-identity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the execution of 'aws sts get-caller-identity' by common IDEs or code editor helper processes. This activity is often used by adversaries to verify the current AWS identity and permissions after gaining access to a developer's workstation.