# Password spraying campaign targets AWS root user accounts across 150+ organizations

DevFeed: [Password spraying campaign targets AWS root user accounts across 150+ organizations](<https://devfeed.tech/articles/password-spraying-campaign-targets-aws-root-user-accounts-across-150-organizations-8272.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign/>)

Author: Martin McCloskey

Published: 2026-08-31T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [IAM](<https://devfeed.tech/topics/iam.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [passwords](<https://devfeed.tech/topics/passwords.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity](<https://devfeed.tech/tags/identity.md>), [password-spraying](<https://devfeed.tech/tags/password-spraying.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

Datadog Security Research describes a password spraying campaign that repeatedly targeted AWS root user accounts at more than 150 organizations between July 24 and August 23, 2026. The campaign used Chrome and Firefox user-agent fingerprints and proxy infrastructure; no successful authentications were observed, and the attackers' motive remains undetermined. The article explains the privileges and safeguards associated with AWS root users and recommends reducing reliance on persistent root credentials.

## Source excerpt

Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations.