DPRK/APT41 Fake Job Interview MCP Chain: git clone → .amazonq/mcp.json → AI Tool Spawn
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Cortex XDR
