BRIEFAccess salehighP55
Pegasus v5.2.1 iOS/Android zero-click exploit suite offered for sale
NSO Group / Pegasus
Detected13 November 2026 · 08:13 UTC
A seller on DarkForums advertises a claimed full Pegasus v5.2.1 zero-click suite for iOS and Android, purportedly derived from an NSO Group leak. If authentic it would provide turnkey remote device compromise capability attractive to government-facing threat actors, though such posts are frequently scams. Defenders of high-value government and executive mobile targets should treat it as a reminder of mercenary spyware risk.
CategoryAccess sale
Severityhigh
Priority score55
Detected13 November 2026 · 08:13 UTC
Access salePriority 58
Venta de acceso inicial a grandes corporacionesA DarkForums user (ducky23) posted on 13 November 2026 offering initial access to 'huge corporations' without naming any victim. Broker posts of this type usually precede SSLVPN, RDP or webshell footholds being resold and are a common precursor to ransomware deployment. Defenders should treat unsolicited corporate access offers as an early-warning signal and hunt for anomalous remote-access logins.Access salePriority 70
Venta de base de datos con credenciales admin de Argentina, Uruguay y ParaguayA seller on DarkForums is advertising a multinational database of administrator usernames and passwords covering sites in Argentina, Uruguay and Paraguay. Admin-level credentials allow direct takeover of control panels and CMS installations rather than simple account abuse, making the set reusable for defacement and further intrusion. The listing carries no verifiable date, so treat it as a live offer until samples are checked.Access salePriority 62
Venta de acceso de administrador al sitio brasileño MontinkAn actor posting as blackhunter1 on the DarkForums marketplace is advertising administrative access to montink.com, a Brazilian print-on-demand e-commerce platform. Admin takeover could expose customer accounts, order and payment data, and allow defacement or malicious script injection on the storefront. This is a live initial-access offer against a real Latin American company and warrants timely verification.Access salePriority 60
Venta de acceso a 7 servidores de ISP en ArgeliaA seller on BreachForums' Access Market is advertising seven compromised ISP provider servers in Algeria, offering buyers a foothold inside telecommunications infrastructure. ISP-level access enables traffic interception, subscriber data theft and malware distribution to downstream customers. Telecom operators in Algeria and the wider region should hunt for intrusions and rotate privileged credentials.Access salePriority 78
Venta de acceso SSH/root a 11 organizaciones en varios paísesA seller on PwsForums is advertising critical SSH/root-level access to 11 separate organizations across various countries, implying full administrative control of compromised servers. Root/SSH access is the highest tier of initial access and enables ransomware deployment, data theft and lateral movement. Organizations exposing SSH services should audit accounts, keys and login telemetry immediately.Access salePriority 44
Venta de acceso a AWS SES con envío masivo de correosA threat actor posting on DarkForums is selling CLI access to AWS Simple Email Service with quotas of 50,000 to 1 million messages. Such access lets buyers send high-volume phishing or spam from a trusted cloud domain, helping them bypass many email filters. Defenders should monitor AWS SES sending anomalies and enforce sending authorization and configuration-set controls.