Password Spraying Campaign Targets AWS Root Accounts in Over 150 Organizations
A password spraying campaign targeted AWS root accounts across more than 150 organizations between July 24 and August 23, 2026. The attacks involved repeated login attempts against identities holding maximum privileges in the cloud.
The root account is created with every AWS account and provides complete access to resources, configurations, billing details, and sensitive administrative functions. A successful compromise could grant broad control over the entire environment.
Researchers recorded a median of two attempts per organization, while some targets received as many as eight attempts. No successful authentications connected to the campaign have been identified to date.
In password spraying, criminals test a small set of common or previously leaked passwords against many accounts. This approach reduces the volume of attempts per user and can evade traditional lockout mechanisms.
The attacks utilized proxies distributed across different countries and networks, including hosting infrastructure and residential proxies. Attackers also employed user agents simulating older versions of Microsoft Edge and Firefox.
To access a root account via the console, an attacker must know the associated email address. This suggests the operators may have obtained such information from prior leaks, reconnaissance, or by testing corporate email lists.
Since June 2025, AWS has required multi-factor authentication for root users, increasing the difficulty of account takeover even when a password is discovered. The company also recommends avoiding everyday use of the root identity and refraining from creating permanent access keys for it.
Related articles
Unsolicited iPhone 15 Pro Max Delivery to Reddit User Sparks Fears of Targeted Cyber Attack
A Reddit user received an unexpected iPhone 15 Pro Max in a sealed box that was never ordered. Apple’s service identified the serial number as belonging to a device purchased or activated in December 2023, with its warranty already expired in 2024, creating a clear mismatch between the new-looking packaging and the device’s documented history. The included FedEx label contained a tracking number that does not exist in the carrier’s system. Discussion on the platform raised the possibility of a targeted attack, potentially a form of whaling, in which the phone could have been pre-modified to steal data or credentials once connected to a network or Apple ID. No concrete evidence confirms the package originated from an attacker, and alternative explanations such as a delivery error or order fraud remain possible. Experts recommend that recipients avoid powering on the device, inserting a SIM card, or entering any account credentials, and instead consider returning it to Apple for inspection or disposing of it as electronic waste.
Scammers Embed Phishing Inside Telegram Mini Apps After August Update
Cybercriminals are increasingly abusing Telegram's Mini Apps and WebView features to deliver phishing attacks that mimic legitimate banking, payment, and cryptocurrency services. Following the platform update on August 25, attackers can now present fake interfaces for transfers, airdrops, and voting systems directly inside the messenger. Victims are tricked into entering confirmation codes, connecting wallets, or pasting commands into PowerShell under the guise of fixing errors or claiming bonuses. The attacks rely heavily on social engineering rather than automated malware, requiring users to actively authorize actions such as signing transactions or providing phone verification details. Fake voting schemes are used to harvest account credentials, while crypto-related lures prompt users to link wallets to malicious services. Experts emphasize that simply opening a Mini App does not lead to immediate theft, but authorizing or connecting assets does expose users to significant risk.
Google Introduces Multi-Step Verification for Android APK Sideloading to Combat Fraud
Google has begun rolling out an enhanced installation flow for Android apps installed outside of Google Play. Users must first confirm that no one is coercing them to enable unknown sources, then reboot their device and wait 24 hours before the option becomes available. The new process includes explicit warnings about scammers who pressure victims into enabling sideloading, noting that legitimate organizations never require this setting. After the waiting period, users can grant the permission for seven days or indefinitely. The change does not affect ADB installations, preserving a workaround for advanced users. Google states the delay is intended to give people time to reconsider before enabling potentially risky settings. An Android Authority poll showed 88 percent of respondents expect further restrictions in the future.
Why 'Be Vigilant' Is Not Enough: Dissecting Human Psychology During Social Engineering Attacks
A cybersecurity expert with years of SOC and pentest experience explains why traditional awareness training fails against social engineering. The article details how attackers exploit psychological levers such as authority, urgency, reciprocity, social proof, and emotion to bypass conscious decision-making. It emphasizes that people who fall for attacks are often the most helpful and diligent employees, not the careless ones. Instead of relying on willpower in stressful moments, organizations must implement procedures that enforce independent verification and protect the right to pause. The piece also highlights how a blame-free culture dramatically reduces incident impact by encouraging early reporting. Technical measures that reduce reliance on a single human decision are presented as effective supplements to policy.