Loading story…
Datadog Security Research identified a password-spraying campaign that made repeated failed AWS ConsoleLogin attempts against root accounts at more than 150 organizations between July 24 and August 23. Victims typically received only a few attempts—median two and as many as eight—with no observed successful authentications or confirmed account compromises. The actors used outdated Chrome/Edge 85 and Firefox 120 user-agent strings and geographically distributed proxy infrastructure spanning multiple countries and autonomous systems.
Because failed root-console authentication requires the email address associated with the AWS root user, the activity indicates the attackers likely obtained root-email addresses or successfully enumerated likely account-email candidates. Organizations should review AWS CloudTrail for root ConsoleLogin events, alert on all root-account activity, eliminate persistent root credentials where possible, and apply distinct protections to management-account root users. Mandatory AWS root-user MFA, enforced since June 2025, can prevent takeover even if a root password is compromised.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Between July 24 and August 23, attackers conducted repeated failed AWS ConsoleLogin attempts against root accounts at more than 150 organizations. Datadog observed no successful authentications or confirmed compromises.
AWS IAM began enforcing multi-factor authentication for root users across all AWS account types, with a 35-day grace period after a root user’s first console sign-in attempt.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcesecuritylabs.datadoghq.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Datadog Security Labs reported a targeted adversary-in-the-middle phishing campaign that impersonated the AWS sign-in experience to steal console credentials and capture MFA codes in real time, enabling attackers to hijack active sessions. The operation used at least three AWS-themed domains registered through **NICENIC INTERNATIONAL GROUP CO., LIMITED** and hosted behind **Cloudflare**, with cloned login pages and server-side logic that handled email, SMS, and authenticator-app MFA prompts. Phishing emails posing as **AWS Support** were sent through legitimate delivery services including **SendGrid** and **Nimbu** to improve deliverability and credibility. Researchers said the kit rendered pages only for pre-validated targets using an encrypted URL parameter, `input_24`, a gating method that likely tied each link to a specific victim and reduced exposure to sandboxes and scanners. Fewer than 50 target addresses were recovered, most tied to US-based software engineers and engineering leaders, and investigators also found a likely attacker validation batch file on VirusTotal. Datadog linked the infrastructure and tradecraft to a broader phishing-kit family previously used in campaigns impersonating **SendGrid**, **Salesforce**, and cryptocurrency wallet brands, indicating a reused and increasingly refined framework that defenders should track through suspicious DNS activity and anomalous **AWS CloudTrail** `ConsoleLogin` events.
Jul 12, 2026
Datadog Security Labs reported an active **adversary-in-the-middle (AiTM)** phishing campaign targeting **AWS Management Console** users with high-fidelity cloned login pages hosted on **typosquatted domains**. The kit acts as a live proxy to the legitimate AWS sign-in flow, relaying authentication in real time to **validate credentials** and capture **session material** (and likely **MFA/OTP codes**) before redirecting victims, enabling rapid post-compromise access to cloud environments. In an observed case, the threat actor accessed a compromised AWS account **within ~20 minutes** of credential submission, with console access originating from `185.209.196.132` (identified as a **Mullvad VPN** egress). Datadog identified **two active infrastructure clusters** and a third related domain, including `cloud-recovery[.]net` (IP `178.16.54[.]142`), `cloud-policy[.]com` (IP `69.67.172[.]30`), and `cloud-recovery[.]us`, with shared registrar metadata (Registrar ID **3254**, CNOBIN INFORMATION TECHNOLOGY LIMITED) and signs of rapid infrastructure rotation. Reporting emphasized the activity is **credential theft** rather than exploitation of an AWS vulnerability or abuse of AWS infrastructure, and that the lure impersonates an “AWS Organization Security” alert with a likely spoofed sender `noreply@security[.]aws`.
Jun 29, 2026
Password spraying has remained a persistent intrusion technique against cloud identity platforms, with CISA warning that attackers commonly target **single sign-on**, federated authentication, and email services by trying a small set of weak passwords across many accounts to avoid lockouts. U.S. authorities linked some activity to Iranian actors tied to the Mabna Institute, while Microsoft later reported that Iran-linked **DEV-0343** sprayed passwords across more than 250 Office 365 tenants, focusing on defense, GIS, maritime, and cargo organizations; fewer than 20 tenants were compromised, and accounts protected by **multifactor authentication** were largely resistant. More recent reporting shows the tactic evolving at scale. SecurityScorecard described a botnet of more than **130,000** compromised devices conducting password spraying against **Microsoft 365** by abusing **Basic Authentication** in non-interactive sign-ins, using credentials from infostealer logs and infrastructure tentatively linked to a likely Chinese-affiliated group. Detection content from Splunk also highlighted **Okta ThreatInsight** alerts for suspected password-spray activity, underscoring that identity providers continue to surface this behavior in telemetry. Across the reporting, defenders are urged to enforce MFA, disable legacy and Basic Authentication where possible, strengthen password policies, and monitor sign-in logs for repeated failures, unusual user agents, and distributed login attempts from many IP addresses.
Aug 15, 2026