The most powerful identity attracts attempts
On August 31, 2026, Datadog Security Labs described a password-spraying campaign against the AWS account root-user console sign-in flow across more than 150 organizations. The observations covered July 24 to August 23. No successful access was identified, but the campaign highlights the value of a root account: it can change account settings, billing, and access controls.
Password spraying tests a small number of secrets across many accounts instead of trying many passwords against one user. This can reduce lockout-related signals while exploiting reused or predictable credentials.
The root user must not become a work account
AWS recommends avoiding the root user for daily tasks and not attaching long-term access keys to it. Administrators should use separate IAM identities with necessary permissions and strong MFA.
For an SMB, the rule is straightforward: use root only for rare operations that require it, monitor its email address, protect recovery MFA, and explain every use.
Four useful checks
- Confirm root MFA is active and that recovery is not shared through email or chat.
- Look for old root access keys and remove them when they are not essential.
- Create named administrator accounts instead of one shared identity.
- Alert on root sign-ins, MFA changes, email changes, billing changes, and IAM policy changes.
The mailbox attached to the root account also needs protection. It is part of the root identity and can become the target of a fraudulent recovery.
Soclyde and privileged access
Soclyde is not an IAM system and does not replace CloudTrail. It can help organize the human secrets around the procedure: recovery passwords, emergency codes, billing access, and information needed for controlled rotation. Each item can be unique, encrypted, and shared with a limited group.
Soclyde's SMB password policy guide provides a basis for separating accounts, documenting responsibilities, and reducing reuse.
The takeaway
A campaign with no confirmed successful access is still a useful signal. It shows why the most powerful accounts should be rare, separate from daily work, monitored, and protected by a recovery process the team has actually tested.
