BeepRAT/CVE-2026-12957 MCP mcp.json AWS credential exfil via bash+curl

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of AWS STS 'get-caller-identity' commands via a network utility (curl) initiated by common development tools like VS Code, node, or amazonq-lsp. This behavior is indicative of potential cloud credential theft or reconnaissance performed through a compromised developer environment.