Datadog Security Research observed a password-spraying campaign targeting AWS root accounts at more than 150 organizations between July 24 and August 23, 2026, with repeated failed console login attempts against highly privileged identities.
The AWS root user is the original identity created when an AWS account is registered. It has unrestricted access to cloud resources, account settings, billing information, and sensitive administrative functions. A compromised root account could give an attacker broad control over an organization’s AWS environment.
Datadog found that most organizations received only a small number of login attempts. The median number of failed attempts per organization was two. At the same time, some victims saw as many as eight during the month-long campaign.
Researchers did not identify any successful authentications, indicating no evidence that the campaign resulted in confirmed AWS account compromises.
The attackers used password spraying, an attack method in which threat actors try a limited set of commonly used or previously exposed passwords against many accounts.
Hackers Target AWS Root Accounts
This approach is designed to avoid triggering account lockouts that may occur during traditional brute-force attacks focused on a single account.
Two browser user-agent strings were repeatedly associated with the activity. One impersonated an older Microsoft Edge browser based on Chrome version 85, while the other impersonated Firefox version 120.
The use of these identifiers may help defenders search logs for related authentication attempts. However, user-agent values can be easily spoofed by attackers.
The campaign also relied on proxy infrastructure. Source IP addresses were distributed across many countries and autonomous systems, making geographic blocking less effective.
Threat intelligence services identified the infrastructure as hosting services, residential proxies, or similar systems commonly used to hide the source of malicious traffic.
Datadog researchers said the victim organizations did not show a clear pattern. Targets spanned multiple industries and countries, suggesting the attackers may have used a broad list of potential AWS account email addresses rather than focusing on a specific sector.
The operation is notable because AWS root console login attempts require the account’s email address, suggesting the attackers may have obtained root account emails through data leaks, public records, phishing, or other reconnaissance.
Another possibility is that the attacker tested a large number of corporate email addresses until valid AWS root identities were identified.
AWS root accounts are particularly sensitive targets because they can perform actions unavailable to ordinary IAM users. However, AWS has introduced stronger root-account protections.
Since June 2025, AWS IAM has enforced multi-factor authentication for root users across all account types, with a 35-day grace period after the first console sign-in attempt.
MFA can prevent account takeover even if an attacker has the correct password. However, organizations should not treat MFA as the only control.
Security teams should review AWS CloudTrail logs for root-level ConsoleLogin events, especially failed attempts using the identified Chrome/Edge and Firefox user agents. They should also alert on direct root sign-ins, root API activity, changes to root credentials, and unusual privileged sessions.
Organizations should minimize routine use of root credentials, enable centralized root access where possible, enforce service control policies that restrict direct root activity in member accounts, and protect management-account root credentials with strong, phishing-resistant hardware MFA.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Hackers Target AWS Root Accounts at 150+ Organizations in Password-Spraying Campaign appeared first on Cyber Security News.