Hackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ Organizations

Gbhackers •Divya • September 1, 2026

Research has discovered a password-spraying campaign targeting AWS root user accounts across more than 150 organizations. This highlights ongoing efforts by attackers to compromise the most privileged identities in cloud environments. The campaign ran from July 24 to August 23, 2026, and involved multiple failed authentication attempts against AWS root accounts. Most affected organizations recorded […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Password Spraying Attacks Target AWS Root Accounts at 150+ Organizations A password-spraying campaign has been identified targeting AWS root user accounts across more than 150 organizations. This campaign occurred from July 24 to August 23, 2026, involving multiple failed login attempts against these highly privileged accounts. The AWS root user is the primary identity created during account registration, granting unrestricted access to cloud resources. Organizations affected by this attack are urged to enhance their security measures to protect against unauthorized access. The attack method exploits weak password policies and the lack of multi-factor authentication. Current status indicates that the campaign has been ongoing, but no specific remediation steps or tools have been detailed in the articles. Security teams are advised to monitor their AWS accounts closely for unusual login attempts. 2 sources 57

Extracted Entities

Hackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ Organizations

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)