Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
Most likely scenario is hackers are trying leaked username/password pairs from other breaches against AWS and gaining access to those accounts.
They then spin up EC2 instances in all sorts of regions on the compromised accounts
PSA set up MFA on your account if you haven't already.
Some examples:
https://www.reddit.com/r/aws/comments/rv3lm5/i_lost_55k_from...
https://www.reddit.com/r/aws/comments/rvbncu/account_hacked_...
https://www.reddit.com/r/aws/comments/qx8i02/got_hacked_and_...
https://www.reddit.com/r/aws/comments/rv4mnq/my_account_was_...