BRIEFAccess salelowP38
64,000 corporate email access credentials posted
Detected21 October 2026 · 21:36 UTC
A freshly posted list of roughly 64,000 corporate business email credentials is circulating. These valid mail-access combos enable credential stuffing and business email compromise across many companies. Not tied to a specific public-sector victim, but useful for defenders to hunt for reused corporate passwords.
CategoryAccess sale
Severitylow
Priority score38
Detected21 October 2026 · 21:36 UTC
Access sale● 38
Oferta de acceso root a servidores sin víctima identificadaA DarkForums marketplace seller posted 'root access' to servers with an 11M figure about eight hours ago, but the listing names no victim, sector or geography. Unattributed root-access offers are usually reposts or resold access rather than fresh intrusions, so value is limited until a target appears. Monitor the thread for samples or a named organisation.Access sale● 42
Venta de acceso RDP con privilegios de administradorA seller on BlackBones is advertising RDP access with administrative privileges, a common initial-access vector for network intrusion and ransomware staging. No specific victim or geolocation is named, so the direct exposure is unknown, but buyers of such access typically use it for lateral movement and data theft. Defenders should treat admin RDP as a high-value foothold and enforce MFA, restrict RDP exposure and monitor for credential reuse.Access sale● 62
Venta de acceso a la base de datos de NIO Power en ChinaA seller is offering access to NIO Power China's database containing user information such as phone numbers and addresses. NIO Power runs EV battery-swap and charging infrastructure, so customer and location records are tied to mobility operations rather than a generic webshop. The data supports phishing, physical tracking and further intrusion attempts against the operator's suppliers.Access sale● 70
Venta de acceso, código fuente y datos de SK TelecomA seller claims to hold corporate access to SK Telecom together with stolen source code and internal data, presenting it as a large-corporation intrusion. SK Telecom is South Korea's largest telecom operator, so repository and access exposure can be chained into network and customer-system compromise. The post is undated, but live access plus code for a tier-1 telco is a high-value sale worth tracking.Access sale● 72
Venta de acceso y código fuente de SK TelecomA seller is advertising access to SK Telecom, one of South Korea's largest carriers, together with source code and internal data. Access plus source code is a high-value combination that enables network intrusion, subscriber-data theft, and IP exfiltration. Buyers could pivot into telecom critical infrastructure, so this warrants tracking and hunting for leaked credentials.Access sale● 48
Venta de webshell y acceso a base de datos de Malasia (0-day)A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.