Datadog Security Research describes a password-spraying campaign against AWS root-user console logins at more than 150 organisations between 24 July and 23 August 2026. The median number of failed attempts per organisation was two; some saw as many as eight.

Datadog says a failed root ConsoleLogin call requires the root user's email address, so the attacker either already had a list of root user email addresses or brute-forced a list until finding valid ones.

Datadog says it has not observed a successful authentication attempt, so it cannot determine the attacker's intent. Organisations should review CloudTrail for unusual root ConsoleLogin failures and keep root use exceptional.