Hackers Spray Passwords Across Hundreds of AWS Root Accounts, Datadog Finds

Datadog Security Research has identified a coordinated password‑spraying operation that targeted the root credentials of Amazon Web Services (AWS) accounts belonging to more than 150 organizations between July 24 and August 23, 2026. The campaign focused on the console login page, generating a high volume of failed attempts against the most privileged identities in each environment.

Password spraying is a low‑and‑slow technique in which attackers try a small set of common passwords across many accounts, deliberately limiting the number of attempts per account to avoid triggering lockout mechanisms. In the cloud context, the AWS root user—created when an account is first opened—holds unrestricted authority over all resources, billing, and security settings, making it a prized target for any adversary who can gain access.

The observed activity involved repeated, short‑burst login attempts from a range of IP addresses, each using widely known passwords such as "Password123" or "Welcome1." By spacing the attempts and rotating source locations, the actors kept the failure rate low enough to stay under the radar of native AWS throttling and alerting thresholds while still probing a large number of accounts.

Although Datadog has not reported any successful compromises linked to this specific campaign, the sheer scale of the attempts underscores a growing willingness among threat actors to chase weak root credentials. A successful breach of a root account would give an attacker the ability to create or delete resources, exfiltrate data, and even manipulate billing information, potentially causing both operational disruption and financial loss.

Security professionals are reminded that AWS recommends never using the root account for routine tasks. Enabling multi‑factor authentication (MFA) on the root user, employing dedicated IAM roles for day‑to‑day operations, and rotating root access keys are considered essential safeguards. Additionally, continuous monitoring of console sign‑in events through services like AWS CloudTrail and GuardDuty can surface anomalous login patterns early.

Datadog’s detection relied on its cloud‑security monitoring platform, which aggregates login logs, correlates IP reputation data, and flags credential‑spraying signatures. The firm’s researchers say the findings illustrate the value of third‑party visibility, especially for organizations that may not have fully instrumented their AWS environments.

The episode arrives amid a broader uptick in credential‑stuffing and password‑spraying attacks aimed at cloud platforms. Remote work, the proliferation of SaaS tools, and the reuse of passwords across personal and professional accounts have expanded the attack surface, prompting both cloud providers and security vendors to enhance detection rules and advisory guidance.

Going forward, experts expect organizations to tighten access controls, enforce MFA universally, and audit root credentials more rigorously. AWS may issue additional best‑practice bulletins or integrate more aggressive anomaly detection into its native services. Law‑enforcement agencies are also likely to monitor the campaign for links to known threat groups, as the exploitation of cloud root accounts remains a high‑priority target in the evolving cyber‑threat landscape.