DATADOG Security Research has described an active AWS password spraying campaign that targeted root user accounts across more than 150 organisations. The attack occurred between 24 July and 23 August 2026, with attackers attempting to log into highly privileged AWS root accounts using repeated failed authentication attempts. Importantly, telemetry within the observation window did not record any successful login events.
The attackers reportedly relied on a distributed approach: they possessed or generated a list of targeted root emails, sent authentication requests through global residential proxies, and mimicked legitimate browser traffic by using specific Chrome and Firefox user agents. This combination was designed to bypass simple geographic blocking filters.
While the scale per target was modest—median two attempts, with some targets experiencing up to eight—the sheer breadth across industries and regions makes the threat notable for cloud administrators.
Root accounts remain a critical risk, given their full access to billing and core settings. Since June 2025, cloud providers have required MFA for root access, but the article underscores that authentication safeguards alone are insufficient. Recommended responses include deploying service control policies to prevent direct root activity within member accounts and treating root activity as security-relevant.
The identity of the threat actors remains unconfirmed, and no objective of the campaign has been established from the observed data. CVEs are cited in related coverage, including CVE-2026-85046, but there is no indication of exploitation tied to this campaign within the article.