Between July 24 and August 23, 2026, security researchers uncovered a widespread password-spraying campaign targeting AWS root user accounts across more than 150 organizations. The attackers attempted console logins tied to highly privileged root identities—the original, all-powerful admins in AWS, capable of accessing billing, account settings, and critical resource controls. Although the campaign was broad, there’s no sign yet of any successful breaches.
What the Attackers Did
The attackers employed password spraying—trying a small number of likely passwords across many accounts to evade detection. Most organizations saw around two failed login attempts, but in some cases, up to eight. They used two specific browser user-agent strings: one mimicking an older Microsoft Edge version built on Chrome 85, and another posing as Firefox version 120. These strings appear repeatedly, likely to aid defenders in spotting malicious activity.
To mask their origins, the threat actors used proxy infrastructure with IP addresses spanning numerous countries and networks, including residential proxies or hosting providers. This complicates geo-blocking or IP-based mitigation efforts. The targets spanned industries and locations, indicating the attackers weren’t zeroing in on any single sector.
What’s At Stake, and Security Controls AWS Offers
Root accounts in AWS are highly sensitive: they can perform operations that even privileged IAM users cannot, including modifying billing, changing root credentials, or full system control. A compromise here could mean severe consequences. Since June 2025, AWS has required multi-factor authentication (MFA) on all root accounts—with a 35-day grace period after first console login—to reduce risk.
Organizational safeguards are still essential. Audit logs for root-level ConsoleLogin attempts—especially failures—should be reviewed, and alerts set up for any direct root sign-ins or changes to root credentials. Best practices include minimizing regular use of root credentials, centralizing root access management where possible, enforcing restrictive service control policies, and protecting root credentials with hardware-based, phishing-resistant MFA.
Though no confirmed root account takeovers have emerged from this campaign, the scale and stealth techniques—proxy use, spoofed user agents, and password spraying rather than brute force—highlight evolving threats in cloud environments.
What this means: This campaign is a warning for any organization using AWS. Attackers are probing root accounts at scale, using low-noise methods that can slip under traditional defenses. If you’re overseeing cloud security, prioritize tightening root account hygiene immediately—mfa, hardware keys, logging, and minimal use are your best bets. Watch the logs, lock down root, and assume your email addresses could already be on attackers’ target lists.
