Password-Spraying Campaign Targets Over 150 Organizations' AWS Root Accounts
A password-spraying campaign between July and August 2026 targeted AWS root accounts at more than 150 organizations, though no successful compromises were confirmed.
Datadog Security Research has identified a widespread password-spraying campaign that targeted the highly privileged AWS root accounts of over 150 organizations between July 24 and August 23, 2026. The campaign involved repeated failed console login attempts, highlighting a significant risk to cloud environments. The AWS root user, being the original identity created with an AWS account, possesses unrestricted access to all cloud resources, billing information, and administrative functions, making its compromise a critical threat.
During the observed period, most targeted organizations experienced only a small number of failed login attempts, with the median being two per organization. However, some victims saw as many as eight attempts within the month-long operation. Crucially, researchers found no evidence of successful authentications, suggesting that the attackers did not achieve any confirmed AWS account takeovers.
The attackers employed a password-spraying technique, which involves attempting a limited set of common or previously exposed passwords against a large number of accounts. This method is designed to evade account lockout mechanisms that might be triggered by traditional brute-force attacks focused on a single account. The campaign utilized specific user-agent strings, one mimicking an older Microsoft Edge browser and another a Firefox version, which could aid defenders in log analysis, although these can be easily spoofed.
Further complicating detection and attribution, the campaign leveraged proxy infrastructure. The source IP addresses were distributed across numerous countries and autonomous systems, rendering geographic blocking ineffective. Threat intelligence indicated that this infrastructure consisted of hosting services, residential proxies, or similar systems commonly used to mask malicious traffic origins.
Datadog researchers noted that the targeted organizations did not exhibit a clear pattern, spanning various industries and countries. This suggests the attackers may have compiled a broad list of potential AWS account email addresses rather than focusing on a specific sector. The operation's nature, requiring root account email addresses for console logins, implies that attackers might have obtained these through data leaks, public records, phishing, or other reconnaissance efforts.
While AWS has implemented stronger protections for root accounts, including mandatory multi-factor authentication (MFA) for root users since June 2025, the campaign underscores the continued importance of robust security practices. MFA can prevent account takeovers even with compromised credentials, but it should not be the sole security measure.
Security teams are advised to meticulously review AWS CloudTrail logs for suspicious root-level ConsoleLogin events, particularly those associated with the identified user-agent strings. Alerts should also be configured for direct root sign-ins, root API activity, credential changes, and unusual privileged sessions. Organizations should minimize routine use of root credentials, enable centralized root access where feasible, enforce service control policies to restrict direct root activity, and protect management-account root credentials with strong, phishing-resistant hardware MFA.