Password-Spraying Campaign Targets AWS Root Accounts at 150+ Organizations

Datadog Security Research identified a password-spraying campaign that made repeated failed AWS ConsoleLogin attempts against root accounts at more than 150 organizations between July 24 and August 23. Victims typically received only a few attempts—median two and as many as eight—with no observed successful authentications or confirmed account compromises. The actors used outdated Chrome/Edge 85 and Firefox 120 user-agent strings and geographically distributed proxy infrastructure spanning multiple countries and autonomous systems.

Because failed root-console authentication requires the email address associated with the AWS root user, the activity indicates the attackers likely obtained root-email addresses or successfully enumerated likely account-email candidates. Organizations should review AWS CloudTrail for root ConsoleLogin events, alert on all root-account activity, eliminate persistent root credentials where possible, and apply distinct protections to management-account root users. Mandatory AWS root-user MFA, enforced since June 2025, can prevent takeover even if a root password is compromised.