Hackers Target AWS root Accounts at 150+ Organizations With Password Spraying Attack

2026-09-02

Datadog Security Labs has identified a password spraying campaign aimed at AWS root accounts across more than 150 organizations. While no successful logins have been confirmed, the attackers' motive remains unclear. Given that AWS root account logins require an email address, it's speculated that the attackers possess a dataset of exposed email addresses for their campaign.