Password Spraying Attacks Target AWS Root Accounts at 150+ Organizations

A password-spraying campaign has been identified targeting AWS root user accounts across more than 150 organizations. This campaign occurred from July 24 to August 23, 2026, involving multiple failed login attempts against these highly privileged accounts. The AWS root user is the primary identity created during account registration, granting unrestricted access to cloud resources. Organizations affected by this attack are urged to enhance their security measures to protect against unauthorized access. The attack method exploits weak password policies and the lack of multi-factor authentication. Current status indicates that the campaign has been ongoing, but no specific remediation steps or tools have been detailed in the articles. Security teams are advised to monitor their AWS accounts closely for unusual login attempts.

Key Points: • Over 150 organizations targeted in a password-spraying campaign against AWS root accounts. • Attack occurred from July 24 to August 23, 2026, involving multiple failed login attempts. • Organizations are advised to enhance security measures, including implementing multi-factor authentication.