BeepRAT/MCP aws sts get-caller-identity Exfil via curl in mcp.json

Ibrahim Saud@tektrix

•updated Jun 30, 2026•8•0•5

Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.