BRIEFAccess salelowP38
Sale of 355 WordPress administrator accesses
Detected1 November 2026 · 22:24 UTC
Actor 'Hurbimor' posted a batch of roughly 355 working WordPress administrator and user credentials on DarkForums on 1 November 2026. Targets are unnamed, so value depends on which sites are compromised; admin access enables defacement, webshell deployment and data theft. Site owners running WordPress should check for rogue admin accounts.
CategoryAccess sale
Severitylow
Priority score38
Detected1 November 2026 · 22:24 UTC
Access sale● 58
Venta de acceso a más de 1.000 redes corporativas empresarialesA BreachForums actor advertises a bulk catalogue of over 1,000 enterprise and corporate network accesses, presented as high-quality corporate footholds. Bulk access brokers of this type resell VPN, RDP and domain credentials that seed ransomware intrusions. Although no specific victim is named, organisations relying on remote-access infrastructure should assume their perimeter credentials may be listed.Access sale● 33
Panel de administración del sitio brasileño ifut.com.br a la ventaA DarkForums actor (jackivaki2) is advertising administrative access to the Brazilian site ifut.com.br. If genuine, it grants full control over the site's content and backend, which can be leveraged for defacement, data theft or hosting malware. The target appears to be a small commercial site rather than critical infrastructure, so impact is limited but it is a live access offer dated today.Access sale● 66
Venta de 19.320 accesos al Gobierno de Malasia en DarkForumsA DarkForums thread advertises the sale of 19,320 accesses tied to the Malaysian government; the body is behind a login wall so the exact nature (credentials, URLs, VPN or panel access) is unverified. If confirmed, this is a bulk batch of entry points into state systems, valuable for intrusion, data theft and espionage. It falls outside Latin America but shows how large government access lots are being marketed.Access sale● 72
Venta de acceso admin a AWS y base de datos de producción (UE)A seller on BreachForums is offering administrative access to a corporate AWS analytics environment plus credentials for a production database, advertised as ready for business email compromise. This is hands-on-keyboard level access to cloud infrastructure and live data, which if purchased allows direct exfiltration, ransomware staging or fraud against the unnamed EU company. Buyers already holding this access represent an immediate risk to the victim and to any partner sharing that cloud tenancy.Access sale● 52
Venta de acceso admin completo a un hotel: web, correo, BD y FTPA seller on the PWN forum is offering administrative access to a hotel with roughly one million in revenue, including full webhosting, mail, database and FTP access. This level of access enables data theft and ransomware deployment against the target and its booking customers.Access sale● 72
Venta de 0-day crítico y 10 millones de datos fiscales de IndonesiaA DarkForums seller advertises a 'critical 0-day' claimed to yield full network compromise plus more than 10 million taxpayer records from Indonesia's tax administration. Offers that bundle an unpatched vulnerability with a demonstrated network foothold and bulk citizen tax data are among the most consequential underground listings, because the 0-day may be reusable against other deployments. Even if partly inflated, it warrants immediate validation by the named agency and by vendors of the implicated software.