BRIEFAccess salehighP72
Critical 0-day and 10M+ Indonesian taxpayer records offered for sale
Indonesian tax authority (claimed)
Detected31 October 2026 · 15:24 UTC
A DarkForums seller advertises a 'critical 0-day' claimed to yield full network compromise plus more than 10 million taxpayer records from Indonesia's tax administration. Offers that bundle an unpatched vulnerability with a demonstrated network foothold and bulk citizen tax data are among the most consequential underground listings, because the 0-day may be reusable against other deployments. Even if partly inflated, it warrants immediate validation by the named agency and by vendors of the implicated software.
CategoryAccess sale
Severityhigh
Priority score72
Detected31 October 2026 · 15:24 UTC
Access sale● 55
Acceso de administrador a la plataforma cripto cryptomia.net a la ventaA DarkForums thread advertises administrative access to cryptomia.net, a cryptocurrency services platform, indicating control over the site's backend panel. Admin access to a crypto service can let an attacker manipulate balances, user data and withdrawals. Operators of similar platforms should rotate credentials, review access logs and enforce MFA.Access sale● 72
Acceso a portal de clientes de distribuidora farmacéutica a la ventaA DarkForums marketplace seller is offering client-portal access to an unnamed pharmaceutical distributor, bundled with roughly 70,000 financial documents and an active unpatched vulnerability. Portal access exposes orders, invoicing and customer data and serves as a foothold for deeper intrusion. Pharma distributors should audit external portals and remediate reported flaws.Access sale● 50
Acceso de administrador a tienda online de Costa Rica a la ventaA DarkForums seller offers administrative access to factoa.net, an e-commerce site in Costa Rica, under 'Source Codes'. Admin panel access allows data theft, payment manipulation and defacement of a Latin American business. The operator should immediately rotate credentials and audit for unauthorized changes.Access sale● 54
Acceso a cuentas del banco Caixa Geral de Depósitos, PortugalA DarkForums post sells access to roughly 1,878 accounts tied to Caixa Geral de Depósitos, Portugal's state-owned bank, out of a 31.10K listing. Compromised online-banking credentials enable unauthorized transfers and account takeover. The bank and its customers should treat affected credentials as compromised and review fraud controls.Access sale● 45
Venta de acceso de administrador a groups.joacademy.com (Jordania)A seller on DarkForums is advertising administrative access to the Jordanian site groups.joacademy.com. Admin-level access to a live web property enables data theft, defacement, or use as a pivot, though the target appears to be a small education platform. It is a confirmed, time-relevant initial-access offer rather than a stale listing.Access sale● 78
Filtración de accesos GitLab de gobiernos de varios paísesA DarkForums user (Pryhotir) posted what is described as leaked GitLab access belonging to government organizations in several countries, published on October 30, 2026. Repository access of this kind exposes source code, CI/CD secrets, internal credentials and documents that can be chained into deeper intrusion. Although no Latin American entity is explicitly named, any public-sector GitLab instance should verify whether its credentials appear in the release.