Hackers Target AWS Root Accounts at 150+ Organizations in Password-Spraying Campaign

Datadog Security Research observed a password-spraying campaign targeting AWS root accounts at more than 150 organizations between July 24 and August 23, 2026, with repeated failed console login attempts against highly privileged identities. The AWS root user is the original identity created when an AWS account is registered. It has unrestricted access to cloud resources, account settings, billing information, and sensitive administrative functions. A compromised root account could give an attacker broad control over an organization’s AWS environment. Datadog found that most organizations received only a small number of login attempts. The median number of failed attempts per organization was two. At the same time, some victims saw...

Read the full article at the source.