Password spraying campaign targets AWS root user accounts across 150+ organizations

Datadog Security Research observed a password spraying campaign targeting the AWS root user account. The campaign ran from July 24 to August 23, 2026.

Number of organizations targeted per day between July 24 and August 23 (click to enlarge)

During this period, attackers made repeated failed authentication attempts against AWS root user accounts at more than 150 organizations. Organizations saw a median of two attempts each, with some experiencing up to eight attempts across the campaign window.

Two fingerprints help identify this campaign:

Two Chrome and Firefox user agents:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.41
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0

Proxies tunneling the authentication requests. Source IP addresses span a wide range of countries and ASNs, and threat intelligence sources flag all of them as hosting infrastructure, residential proxies, or similar.

Targeted organizations also show no clear victimology: they vary widely by country and industry.

We have not observed a successful authentication attempt, so we cannot determine the attacker's intent.

AWS sign-in page showing the root user option, which requires the email address associated with the account (click to enlarge)

This campaign has one notable feature: generating a failed ConsoleLogin API call requires the email address associated with the root user account. This means the attacker either already had a list of root user email addresses, or brute forced through a list of account email addresses until finding a valid one.

Given the limited information available and the apparently random selection of targeted organizations, we cannot conclusively determine the motive behind this attack. We are sharing this activity with the community regardless. If you have observed similar activity and want to collaborate, let us know at securitylabs@datadoghq.com.

A primer on the AWS root user

The AWS account root user is the identity created when an AWS account is registered. It has complete access to the account's resources, billing information and account settings, including certain actions that no other identity can perform.

The root user account is an unusual attack target for two reasons:

AWS recommends monitoring all root user activity, so root actions likely draw more scrutiny than actions by other highly privileged identities.
As of June 2025, AWS IAM enforces multi-factor authentication (MFA) for root users across all account types. A 35-day grace period separates the first console sign-in attempt from MFA registration.

Given these safeguards, targeting the root user takes more effort than easier paths to unauthorized AWS access, such as stolen access keys.

Reducing reliance on the AWS root user

Organizations should reduce their dependence on persistent root credentials rather than rely on MFA alone. AWS Organizations service control policies can prevent direct root activity in member accounts. Centralized root access lets organizations remove long-term root credentials and perform privileged tasks through short-lived, centrally authorized AssumeRoot sessions. Neither control protects the organization's management account, so its root credentials need separate safeguards.

Organizations should also treat all root activity as security-relevant, and alert on direct root sign-ins, root API activity, credential changes, and centrally initiated privileged sessions recorded in CloudTrail.

How to know if you're affected

You can query CloudTrail logs to check whether this campaign affected you:

source:cloudtrail @userIdentity.type:Root @eventName:ConsoleLogin 
@responseElements.ConsoleLogin:(Failure OR Success) 
@userAgent:("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.41" OR "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0")

Failed AWS root user console login sample (shortened for readability):

{
    "userIdentity": {
        "type": "Root",
        "principalId": "123456789012",
        "arn": "arn:aws:iam::123456789012:root",
        "accountId": "123456789012",
        "accessKeyId": ""
    },
    "eventTime": "2026-08-16T04:33:40Z",
    "eventSource": "signin.amazonaws.com",
    "eventName": "ConsoleLogin",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0",
    "errorMessage": "Failed authentication",
    "requestParameters": null,
    "responseElements": {
        "ConsoleLogin": "Failure"
    },
    "additionalEventData": {
        "LoginTo": "https://us-east-1.console.aws.amazon.com/billing/home?region=us-east-1&state=hashArgs%23%2Faccount&isauthcode=true",
        "MobileVersion": "No",
        "MFAUsed": "No"
    },
    "readOnly": false,
    "eventType": "AwsConsoleSignIn",
    "managementEvent": true,
    "eventCategory": "Management"
}