Hackers Target AWS Root Accounts at 150+ Organizations in Password

Cybersecuritynews •Abinaya • September 1, 2026

Datadog Security Research observed a password-spraying campaign targeting AWS root accounts at more than 150 organizations between July 24 and August 23, 2026, with repeated failed console login attempts against highly privileged identities. The AWS root user is the original identity created when an AWS account is registered. It has unrestricted access to cloud resources, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Password Spraying Attacks Target AWS Root Accounts at 150+ Organizations A password-spraying campaign has been identified targeting AWS root user accounts across more than 150 organizations. This campaign occurred from July 24 to August 23, 2026, involving multiple failed login attempts against these highly privileged accounts. The AWS root user is the primary identity created during account registration, granting unrestricted access to cloud resources. Organizations affected by this attack are urged to enhance their security measures to protect against unauthorized access. The attack method exploits weak password policies and the lack of multi-factor authentication. Current status indicates that the campaign has been ongoing, but no specific remediation steps or tools have been detailed in the articles. Security teams are advised to monitor their AWS accounts closely for unusual login attempts. 2 sources 57

Extracted Entities

Hackers Target AWS Root Accounts at 150+ Organizations in Password

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)