Loading story…
AWS announced a gradual rollout of a redesigned sign-in and sign-up experience that changes how some customers access AWS accounts. The update introduces a unified email entry point for root users and certain newly created accounts, refreshed session-selection pages, and support for signing in with supported identity providers for eligible accounts. AWS said existing customers will keep using their current credentials and sign-in methods, and the changes are being introduced to a limited set of users first.
AWS said organizations using IAM Identity Center or federation should continue to use their existing organizational access portals or federation URLs, while customers authenticating with traditional IAM users and root user credentials should review the updated flow. The company also warned that teams relying on browser automation or scripted sign-in workflows may need to validate compatibility with the new interface as the rollout expands.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
AWS announced a gradual rollout of a redesigned AWS sign-in and sign-up experience to a limited number of customers. The update adds a unified email entry point for root users and certain newly created accounts, refreshed session selection pages, and supported identity-provider sign-in for eligible accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS is rolling out a simplified sign-up experience that lets customers use Google, GitHub, or Apple identities to create a preconfigured project with Free Tier credits and configurable monthly spending limits. The environment is implemented as a restricted three-account AWS Organization sandbox—comprising a user-facing member account plus hidden management and identity accounts—and can pause projects or apply controls that prevent new workload creation after a budget threshold is reached. AWS also automates service permissions through console workflows, coding agents, and IAM Role Manager, reducing the need to create IAM users, trust policies, or service permissions manually. Security researchers found the sandbox is designed for onboarding and cost control rather than a complete security baseline. It does not enable CloudTrail and blocks GuardDuty, Security Hub, Detective, Inspector, Macie, and IAM Access Analyzer; it can also allow IAM access keys, public S3 buckets after protections are disabled, and EC2 instances using IMDSv1. Generated roles remain visible and modifiable, but may receive broad permissions such as `PowerUserAccess` where AWS cannot infer required access, requiring review and least-privilege refinement. Organizations needing centralized governance, multiple Regions, or full security-service coverage must enable advanced features and review inherited automated access rules and restrictive sandbox policies.
Sep 17, 2026
Datadog Security Research identified a password-spraying campaign that made repeated failed AWS ConsoleLogin attempts against root accounts at more than 150 organizations between July 24 and August 23. Victims typically received only a few attempts—median two and as many as eight—with no observed successful authentications or confirmed account compromises. The actors used outdated Chrome/Edge 85 and Firefox 120 user-agent strings and geographically distributed proxy infrastructure spanning multiple countries and autonomous systems. Because failed root-console authentication requires the email address associated with the AWS root user, the activity indicates the attackers likely obtained root-email addresses or successfully enumerated likely account-email candidates. Organizations should review AWS CloudTrail for root `ConsoleLogin` events, alert on all root-account activity, eliminate persistent root credentials where possible, and apply distinct protections to management-account root users. Mandatory AWS root-user MFA, enforced since June 2025, can prevent takeover even if a root password is compromised.
Sep 5, 2026
Elastic Security Labs detailed how AWS Security Token Service (STS) `AssumeRoot` can be abused when an IAM principal has overly broad permissions in an AWS Organization. The API issues temporary, task-policy-scoped credentials for the root user of a member account; in the demonstrated white-box scenario, an attacker used the `IAMCreateRootUserPassword` task policy to create a root login profile and prepare persistent console access. Completing the takeover would also require access to the member account’s root-email inbox to reset or establish the root password. Elastic reported no publicly known in-the-wild abuse at the time of publication. Organizations should restrict `AssumeRoot` permissions and approved task policies to narrowly defined administrative roles, review delegation across member accounts, and enforce MFA and root-account credential guardrails. Security teams should retain organization-wide CloudTrail visibility and alert on unusual or rare `AssumeRoot` calls, especially when followed by root `CreateLoginProfile` activity, as these events may indicate an attempt to establish root-level persistence in a member account.
Aug 26, 2026