AWS Credential Enumeration via aws CLI Spawned from Amazon Q MCP Process

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

Detects execution of AWS CLI subcommands used for credential or identity enumeration (e.g., sts get-caller-identity, iam get-user) when spawned from Amazon Q-related or development environment processes (Node.js/VS Code). This behavior is indicative of potential malicious activity involving a compromised MCP server configuration file (CVE-2026-12957).