BeepRAT/CVE-2026-12957 MCP Server AWS Credential Exfil via curl

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•9

Detects unauthorized execution of AWS CLI commands within a shell spawned by Amazon Q or AWS language server processes. This activity typically involves the 'aws sts get-caller-identity' command being piped to 'curl' for remote exfiltration of cloud credentials, a behavior associated with the exploitation of CVE-2026-12957 in MCP auto-execution.