BRIEFAccess salelowP42
Sale of 60,000 corporate email access credentials
Detected8 October 2026 · 16:21 UTC
A seller is listing 60,000 'corporate' mailbox access credentials, refreshed on 08.10, intended for phishing and BEC-style abuse. Corporate mail access sales are a common precursor to invoice fraud and lateral movement against named organizations. The lack of an identified victim keeps impact moderate, but defenders should watch for credential-stuffing and inbox-rule abuse.
CategoryAccess sale
Severitylow
Priority score42
Detected8 October 2026 · 16:21 UTC
Access sale● 55
Venta de acceso de administrador y buzones de multinacionales de EE. UU.A seller is offering administrative and mailbox access to multiple large US multinational companies. This kind of persistent access enables business email compromise, internal phishing and lateral movement across corporate networks. Security teams at affected enterprises should review recent admin-account and mailbox activity.Access sale● 58
Venta de acceso a una organización médica de Estados UnidosA threat actor is advertising access to a US-based medical organization, typically via stolen credentials or remote access. Healthcare access sales feed ransomware deployment and theft of protected health data. Defenders in healthcare should treat this as an active intrusion opportunity to hunt for.Access sale● 30
Comprador busca cuentas bancarias de Chile y ColombiaA carding-forum post solicits the purchase of bank accounts from Chile and Colombia, indicating demand for mule or onboarding accounts in the region. This signals ongoing financial-fraud operations targeting Latin American banks. Relevant for regional AML and fraud defenders, though low individual impact.Access sale● 68
Base de datos del Ejército de Indonesia (TNI AD) a la ventaA forum seller posted a database purportedly belonging to TNI Angkatan Darat, the Indonesian Army, minutes ago. Sale of military personnel or asset data is high impact, enabling identity theft, targeting of service members and potential operational exposure. Though outside Latin America, military database sales are priority intelligence for defenders.Access sale● 55
Acceso completo a la aseguradora Hosn Al Sharjah (EAU) en ventaA forum user claims to have compromised Hosn Al Sharjah, a UAE insurance provider, and is offering full SMB access. Unauthorized access to an insurer risks customer PII and policy data. The claim is unverified but is a live access offer worth tracking.Access sale● 64
Venta de acceso corporativo a GNC Corp (Tanzania)A seller on a darkweb marketplace is offering corporate network access to GNC Corp in Tanzania, posted within the last day. Although outside Latin America, it is a live initial-access offer against a named company that could enable intrusion, fraud or lateral movement depending on the privileges obtained. Access brokers routinely resell such footholds to ransomware crews, so defenders should monitor even if the target's regional relevance is limited.