BRIEFAccess salehighP79
15,000 valid Caixa (caixa.gov.br) credentials offered for sale
Caixa Econômica Federal
Detected4 November 2026 · 13:24 UTC
SUB-ZER0 listed roughly 15,000 valid, checked usernames tied to caixa.gov.br on DarkNetArmy, posted within the last half hour. Caixa is Brazil's state-owned federal bank, so verified account pairs enable account takeover, fraud against benefit payments and lateral abuse of internal portals. The seller claims the credentials were validated, which raises the likelihood of immediate exploitation.
CategoryAccess sale
Severityhigh
Priority score79
Detected4 November 2026 · 13:24 UTC
Access sale● 54
3.500 credenciales válidas de Itaú Brasil verificadas a la ventaA fresh DarkNetArmy post by SUB-ZER0 offers about 3,500 validated usernames linked to itau.com.br, part of the same batch as larger Caixa and Nubank listings. The volume is modest but targets Brazil's largest private bank, where even a few valid accounts can enable fraud or abuse of online banking portals. It should be read as a signal of active credential harvesting against Brazilian financial institutions.Access sale● 62
Venta de acceso a empresa de VFX de EE. UU. con ingresos de 202 M$An actor on the Pwn Forum is advertising initial access to a US visual-effects company reportedly generating $202M in revenue. The listing sits behind a login wall, so the access vector, price and proof are undisclosed, but access to a firm of this size could enable ransomware deployment or large-scale data theft.Access sale● 72
Datos de 656.000 personas y acceso al sistema de la Universidad de Hong KongA DarkForums listing claims 656,000 personal records from Hong Kong Metropolitan University plus access to its internal systems, combining a bulk data leak with a network foothold. University systems hold student, staff and research data, and access sales often precede ransomware or further intrusions against academic and public institutions in the region. The post date and proof samples were not visible, so recency and authenticity still need confirmation before escalation.Access sale● 78
Venta de acceso completo a la infraestructura del distrito municipal de Jinzhou (China)A seller on DarkNetArmy is advertising full infrastructure access to a Chinese municipal government district, including digital access to sensitive internal data. Government-grade access of this kind enables data theft, lateral movement and potential disruption of public services. It is a named, high-value government target that warrants monitoring even outside the LATAM region.Access sale● 38
Acceso a sistemas Windows con datos del sector salud de IránA poster on DarkForums claims to have gained access to Windows systems containing Iranian healthcare sector data and is offering it via a dox thread. Healthcare environments hold sensitive patient records and often run legacy Windows hosts prized by ransomware crews. Any confirmed access to Iranian health infrastructure raises risk of data theft and service disruption.Access sale● 88
Venta del sistema vehicular de la Ciudad de MéxicoThreat actor 'cenfecracked' is advertising the sale of Mexico City's vehicular system on DarkForums in a post dated 2 November 2026, implying access to or data from a municipal vehicle-registration/transport platform. Such systems hold owner PII, plate and verification records and support government services, so a compromise enables identity fraud and service disruption. It directly targets Latin American public infrastructure, making it a priority for regional defenders.