BRIEFAccess salehighP60
phpMyAdmin credentials of Mexico's ITESHU offered for sale
ITESHU (México)
Detected26 September 2026 · 23:17 UTC
Reposts collapsed2
Credentials for the phpMyAdmin panel of ITESHU, a Mexican higher-education institute, are being offered on a hacking forum. Access to phpMyAdmin usually means direct control over the institution's backend databases, risking exfiltration or tampering of student and administrative records. This is a timely lead for defenders at Mexican public education institutions.
CategoryAccess sale
Severityhigh
Priority score60
Detected26 September 2026 · 23:17 UTC
Access salePriority 38
Venta de acceso de administrador al sitio del servicio de ambulancias de HanóiA forum seller on DarkForums is offering administrative access to hanoiambulances.vn, the website of an emergency medical transport provider in Vietnam. Admin panels of health and emergency services allow content tampering, data theft of patient requests and abuse of the domain for phishing. Scale and access method are not disclosed, so impact is limited but worth tracking for the health sector.Access salePriority 55
Venta de acceso admin a la Universidad Técnica de Cluj-NapocaA DarkForums listing offers administrative access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. Campus admin access can be leveraged to reach student records, internal systems and to pivot toward supply-chain partners. Access to a major technical university is a credible stepping stone for further intrusion.Access salePriority 62
Venta de acceso admin al portal gov.in de Odisha, IndiaThreat actor Mellirix is selling administrative access to the Indian government portal igrodisha.gov.in on DarkForums. Admin control could expose citizen registration records and allow tampering with official services. Government portal compromises are high-value for fraud and data theft.Access salePriority 66
Venta de acceso root y VPN a una pasarela corporativa de VietnamA seller on BreachForums' Access Market is offering a root shell on a Vietnamese corporate gateway together with working VPN accounts. This is a concrete initial-access sale combining privileged shell access and valid VPN credentials, which can be used for lateral movement, data theft or ransomware staging. Defenders should treat it as an active intrusion capability against exposed enterprise gateways.Access salePriority 42
Venta de acceso a un proveedor de software como servicio (SaaS)A seller on BreachForums' access marketplace is offering initial access to an unnamed software-as-a-service provider. The listing does not disclose the tenant, scale or access method, but SaaS footholds are often used to pivot into customer data and downstream client organizations. Because the target is unidentified, the item is worth monitoring rather than treating as a confirmed high-value compromise.Access salePriority 45
Acceso a la base de datos del sitio español Andanar.com a la ventaDatabase access for the Spanish site Andanar.com is being sold on DarkForums by a seller using the handle PrimeVendor. Selling live database access to a Spanish company's site risks exposure of customer records and personal data. Spanish organizations and the site's users should monitor for data exposure.