BRIEFAccess salelowP42
Broker offers 'any initial access' on underground forum
Detected19 October 2026 · 17:39 UTC
An actor on a French-language underground forum advertises providing 'any initial access' for sale, signaling an on-demand intrusion/access-broker service. No specific victim, region, or access type (VPN, RDP, webshell) is disclosed in the public title, so it cannot be tied to a named target. It is worth tracking as an access-broker lead but is low-confidence without further detail.
CategoryAccess sale
Severitylow
Priority score42
Detected19 October 2026 · 17:39 UTC
Access sale● 30
Venta de acceso de administrador al centro educativo búlgaro KindyrooA seller claims to have administrative and database-level access to kindyroo.bg, a Bulgarian early-education center. The target is small and outside Latin America, so regional impact is minimal, but the offer illustrates a live web-facing access sale that could be reused against franchise or partner infrastructure. No evidence of government or critical-infrastructure involvement was found in the post.Access sale● 52
Venta de exploit 0day para robar cuentas de GoogleA one-click Google account-takeover 0day is being sold, reportedly bypassing authentication to compromise Gmail and Google Workspace accounts. This threatens mass account takeover, including government and corporate users who rely on Google. Given its freshness and impact, defenders should watch for phishing campaigns or anomalous logins.Access sale● 74
Venta de acceso Domain Admin (AD) a empresa SaaS de República ChecaA seller is offering Active Directory Domain Admin access to a Czech Technology/SaaS company with roughly $100M–$250M revenue, implying full domain control over corporate identities and endpoints. Such access enables lateral movement, ransomware staging and data theft across the entire estate. It is a high-value target worth tracking for acquisition and downstream attack risk.Access sale● 47
Venta de clave API de VirusTotal Enterprise (GTI) con 3M peticiones al mesA seller is offering a working VirusTotal Enterprise/GTI API key with a 3 million requests per month quota and Retrohunt access. Abuse of such a key lets an adversary quietly test malware against dozens of engines and hunt samples without attribution limits, degrading defenders' detection edge and OPSEC. Security teams should check whether any keys from their tenancy have been leaked or shared.Access sale● 50
Venta de acceso de administrador a Vipdestek (Turquía)A seller posted full administrative access to Vipdestek.com, a Turkish hosting and domain services company, including a multi-page thread with presumed proof. Admin control of a hosting provider can mean control over hosted customer sites, DNS and mail, making it a pivot point for supply-chain style attacks. The post dates from April 2026, so it is not a fresh alert, but the offer may still be live or reused.Access sale● 36
Comparten una webshell recién subida en foro de hackingA user on Cracked.st is sharing a 'freshly uploaded shell,' an interactive webshell that gives remote control of a compromised web server. No specific victim or domain is named, so it cannot yet be tied to a known target, but shared shells are often repurposed for defacement, data theft, or as a foothold. Worth monitoring in case the same kit or infrastructure reappears.