Reported by 2 outlets
Hackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ Organizations
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ Organizations
gbhackers.com · 42d ago · September 1st, 2026
Research has discovered a password-spraying campaign targeting AWS root user accounts across more than 150 organizations. This highlights ongoing efforts by attackers to compromise the most privileged identities in cloud environments. The campaign ran from July 24 to August 23, 2026, and involved multiple failed authentication attempts against AWS root accounts. Most affected organizations recorded […] The post Hackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Hackers Target AWS Root Accounts at 150+ Organizations With Password Spraying Attacks
cyberpress.org · 42d ago · September 1st, 2026
Datadog Security Labs observed the activity from July 24 through August 23, 2026. During the month-long campaign, attackers generated repeated failed authentication attempts against AWS root accounts. Most affected organizations recorded a median of two attempts, although some saw as many as eight attempts. Martin McCloskey has not identified a successful login associated with the operation, leaving the attackers’ ultimate objective unclear. Hackers Target AWS Root Accounts at 150+ Organizations The activity relied on a broad, proxy-backed infrastructure to tunnel authentication requests. The source IP addresses were distributed across multiple countries and autonomous systems, with threat intelligence services classifying the infrastructure as hosting providers, residential proxy networks, or similar anonymization services. This infrastructure makes IP-address blocking less reliable and complicates attribution efforts. Datadog researchers also found no clear victimology pattern. The affected organizations operated across various industries and geographic regions, indicating that the campaign was likely opportunistic rather than targeted at a particular sector or region. Two browser user-agent strings were consistently associated with the suspicious AWS login attempts: Mozill