BRIEFAccess salehighP76
Access to the Malaysian Armed Forces payroll system
Malaysian Armed Forces
Detected30 October 2026 · 13:24 UTC
A DarkForums post by user Ixtenor advertises access tied to the Malaysian Armed Forces payroll system, one of the most sensitive HR and finance platforms of a national military. Payroll systems concentrate service numbers, bank accounts and salary data for uniformed personnel, which enables fraud, insider targeting and espionage. Even if unverified, it should be checked against any defence-sector credentials or vendor portals exposed in recent stealer logs.
CategoryAccess sale
Severityhigh
Priority score76
Detected30 October 2026 · 13:24 UTC
Access sale● 48
Acceso cPanel al sitio saudí saj.org.sa en ventaUser Phyvuval offered working cPanel credentials for the Saudi domain saj.org.sa, a hosting-panel compromise that typically allows webshell deployment, mail interception and defacement. Panel access is a stepping stone to phishing infrastructure on a trusted domain and can expose site databases. Single-site cPanel sales are lower impact than corporate VPN access but still actionable if the domain is used for official communications.Access sale● 91
Venta de acceso a correo .gov de ArgentinaA seller using the handle karsovx posted on DarkForums' Sellers Place a sale of access to Argentine .gov email accounts, dated 29 October 2026 — one day before this alert. Government mailbox access enables password resets on other state services, internal phishing from trusted domains and impersonation of officials. Given the .gov.ar scope, any confirmed access should be treated as a potential intrusion into Argentine public administration.Access sale● 45
Venta de 30 accesos activos a cPanel, webmail y SSHA Niflheim forum seller is advertising a batch of roughly 30 verified live cPanel, webmail and SSH credentials dated 30 October 2026. Bulk hosting-panel access is commonly used for website defacement, phishing page hosting and lateral movement into shared hosting environments. Organizations running their sites or mail on shared cPanel infrastructure should treat this as a live credential-exposure risk, especially where MFA is absent.Access sale● 76
Venta de acceso a la infraestructura de SITA y tres aerolíneasA seller in the BreachForums marketplace section is advertising access to sita.aero, the airline IT and communications provider whose reservation, check-in and baggage systems underpin most global carriers, claiming it includes infrastructure of three unnamed airlines. Compromise of such shared aviation infrastructure could disrupt airline operations and expose passenger and partner data across many countries. The seller, price and the specific airlines remain unverified.Access sale● 62
Venta de acceso al panel de superadmin de Vijay Sales con 3M de datosA seller on DarkForums is offering 3M+ records together with Super Administrator panel access to vijaysales.com, an Indian electronics retailer, pointing to a full backend compromise. Admin-level access exposes customer PII, order and payment data and lets the actor manipulate the storefront directly. Retail and payment partners should assess exposure and monitor for reuse of the leaked data.Access sale● 68
Venta de acceso SSH a una inmobiliaria de NoruegaForum user 'tiger' is selling SSH access to a Norwegian real estate group reporting $1B–$5B in annual revenue, listed on the Spear.cx marketplace through the SiberianShelves channel and posted one day ago. Shell access at that level lets an intruder reach internal file servers, tenant and contract data, and use the host as a pivot into partner and property-management networks. Nordic real estate and property firms should treat this as an active exposure.