CVE-2026-12957 BeepRAT MCP AWS Credential Exfil via bash+curl

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.