Datadog reported a password spraying campaign targeting AWS Root users across 150+ organizations, with no confirmed successful logins so far.
Datadog's security research team, part of the cloud monitoring and security company Datadog, disclosed a password spraying attack targeting AWS Root users, with AWS accounts belonging to more than 150 organizations in scope. Researchers observed repeated login attempts against highly privileged Root accounts, but no evidence of any successful logins has been found so far.
The key issue in this incident is not that a single account was breached, but that attackers explicitly targeted the Root identity, which has full account access. Because the Root user has the highest level of privilege at the AWS account level, successful compromise would have far more serious consequences than abuse of a normal IAM user or role.
This attack is a password spraying campaign, meaning that a small number of common or known passwords are tried at low frequency across many accounts to reduce the chance of detection. Datadog said the activity observed by the research team consisted of repeated failed authentication attempts against AWS Root user accounts.
Notably, Datadog stated that generating a single failed ConsoleLogin API call requires knowledge of the email address associated with the Root user account. This indicates that the attackers either already possessed a set of AWS Root user email addresses or were testing large numbers of account emails one by one to identify valid associated addresses. As a result, the prerequisite for this activity was not just guessing passwords, but first obtaining or deriving usable login identifiers.
It remains unclear where these email addresses came from, and the attackers' ultimate objective has not been confirmed. Based on the current intelligence, the attack chain stopped at repeated authentication attempts, with no signs of successful logins, lateral movement, data theft, or privilege escalation. Therefore, this incident appears to be a large-scale test and probe against AWS high-privilege entry points rather than a confirmed full compromise.
Since 2025, AWS has required multifactor authentication (MFA) for Root users across all AWS account types, which raises the bar for password spraying success. However, the researchers also clearly recommended that organizations reduce their reliance on long-lived Root user credentials and not rely solely on MFA as the defense line. The reason is straightforward: as long as the Root identity remains a routinely accessible login point, it will continue to be one of the most valuable targets for attackers.
The first affected area is AWS account administration. The Root user is not a normal privilege account, but a critical identity that can perform the highest-level actions across the entire account. If the attack had succeeded, the impact could have extended directly to high-risk account-level operations.
Second, this incident highlights governance risks around account email addresses and login identifiers. If attackers have obtained the Root login email, they can shift their focus directly from finding accounts to spraying passwords against those accounts. This turns what may seem like a dispersed set of accounts into a batch of high-value targets from the attacker's perspective.
Third, although there is currently no evidence of successful logins, the fact that more than 150 organizations were included in the attack range shows that this kind of activity is scalable. For cloud security teams, this means the threat is not limited to known vulnerabilities or malware, but also includes poor management of the exposure surface of high-privilege identities.
First, treat the Root user as an exception identity reserved for very few administrative tasks, not as a daily management account. Datadog's research clearly indicates that reducing reliance on long-lived Root credentials is more important than simply strengthening a single login mechanism.
Second, confirm that all AWS Root users have MFA enabled and verify that the related settings remain effective. MFA does not eliminate risk, but it can effectively increase the cost of password spraying and brute-force attempts, reducing the attack success rate.
Third, review whether the Root account still retains unnecessary long-term credentials or habits of daily use. If teams are still using Root for routine operations, the process should be adjusted immediately so that everyday actions return to the principle of least privilege and role delegation.
Fourth, establish monitoring and alerts for login events. Security teams should continuously watch for Root login failures, unusual sources, and repeated attempts in a short time frame to identify password spraying behavior early.
Fifth, re-evaluate the email management strategy associated with the Root account. If Root login identifiers are leaked or enumerable, attackers can rapidly start a password spraying workflow, so account identifiers, mailbox protection, and internal controls must be designed together.
The main point of this incident is not just that AWS Root was targeted, but that high-privilege cloud identities are being systematically probed. In cloud environments, the greatest danger is often not a single vulnerability, but a high-value login surface that can be reused repeatedly. When Root remains an active identity that can be logged into, organizations must treat it as a top-priority asset for protection.
For security teams, the real goal is not to make Root passwords harder to guess, but to make Root unnecessary for day-to-day operations. Only by minimizing high-privilege actions and reducing credential exposure as much as possible can cloud accounts maintain overall resilience against large-scale password spraying.