BeepRAT/MCP AWS Credential Theft via aws sts get-caller-identity in IDE

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of 'aws sts get-caller-identity' from unexpected or potentially suspicious parent processes such as Node.js, bash/sh, or IDE-related processes like VS Code or Amazon Q. This command is often used by developers to confirm identity, but when triggered from these contexts, it may indicate unauthorized access or exploration by an adversary operating within a development environment.