Password spraying campaign targets AWS root user accounts across 150+ organizations

Datadog Security Research observed a password-spraying campaign from July 24 to August 23, 2026 that attempted repeated AWS root user ConsoleLogin authentications against over 150 organizations (median two attempts each). The report provides two distinct browser user-agent fingerprints, notes the use of proxy/residential infrastructure for source IPs, includes a CloudTrail query and a sample failed ConsoleLogin event, and recommends reducing persistent root credentials, alerting on root activity, and using AWS Organizations controls to limit root usage.