Root login is a direct sign-in to the highest-privilege account on a Unix-like system, often over SSH. Because the root user can read, change, or delete almost anything, a successful login gives an attacker immediate full control. That makes root access far more dangerous than compromise of a normal account, especially when the service is exposed to the internet.
In attacks, root login is often the goal of password guessing, credential stuffing, or valid-account abuse. Even a failed login probe matters, because repeated attempts can reveal weak passwords, trigger account testing, or confirm that an SSH service is reachable. Defenders usually reduce risk by disabling direct root SSH access, requiring separate administrative accounts, enforcing MFA, and monitoring authentication logs for repeated failures or unusual source addresses. If an attacker ever reaches root, later malware may be unnecessary: the system is already fully exposed.