A password spraying campaign targeted AWS root accounts across more than 150 organizations between July 24 and August 23, 2026. The attacks involved repeated login attempts against identities holding maximum privileges in the cloud.
The root account is created with every AWS account and provides complete access to resources, configurations, billing details, and sensitive administrative functions. A successful compromise could grant broad control over the entire environment.
Researchers recorded a median of two attempts per organization, while some targets received as many as eight attempts. No successful authentications connected to the campaign have been identified to date.
In password spraying, criminals test a small set of common or previously leaked passwords against many accounts. This approach reduces the volume of attempts per user and can evade traditional lockout mechanisms.
The attacks utilized proxies distributed across different countries and networks, including hosting infrastructure and residential proxies. Attackers also employed user agents simulating older versions of Microsoft Edge and Firefox.
To access a root account via the console, an attacker must know the associated email address. This suggests the operators may have obtained such information from prior leaks, reconnaissance, or by testing corporate email lists.
Since June 2025, AWS has required multi-factor authentication for root users, increasing the difficulty of account takeover even when a password is discovered. The company also recommends avoiding everyday use of the root identity and refraining from creating permanent access keys for it.
