BeepRAT/CVE-2026-12957: Amazon Q MCP Auto-Exec Shell Spawn from VS Code

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of AWS Security Token Service (STS) CLI commands (such as get-caller-identity) initiated by development-related processes like VS Code (Code.exe), Code Helper, or Node.js. This behavior may indicate an attacker leveraging developer environments to perform cloud infrastructure discovery or enumerate AWS permissions.