BRIEFAccess salehighP38
Admin access to Australian education portal eit.edu.net.au for sale
eit.edu.net.au
Detected22 September 2026 · 21:43 UTC
A forum user is advertising administrator-level access to eit.edu.net.au, an Australian education site, dated March 2026. Admin access to an academic portal can enable data theft, defacement or lateral movement into connected systems. The listing is already months old, so it is a stale access offer rather than a live incident.
CategoryAccess sale
Severityhigh
Priority score38
Detected22 September 2026 · 21:43 UTC
Access sale● 62
Venta de acceso a un centro de mando de tráfico gubernamental en IránA seller on DarkForums is advertising access to the Iranian Smart Traffic Control Command Center of the Tehran Traffic Police, a government-operated transport/critical-infrastructure system. If genuine, control-plane access to traffic signalling and monitoring could enable physical disruption and safety incidents, not just data theft. It shows access brokers pursuing government OT/ICS targets and is worth tracking for TTPs even though the region is outside LATAM.Access sale● 55
Venta de acceso a cuenta corporativa de una empresa de TIA threat actor is selling access to a corporate Microsoft account along with Tally Prime accounting software tied to an IT company. This kind of access enables business email compromise, invoice fraud and lateral movement into the victim's finance systems. Buyers typically use such credentials for wire fraud and data theft.Access sale● 52
Venta de acceso de administrador a la web paquistaní Pomilights.pkA threat actor is selling administrator-level access to Pomilights.pk, a Pakistani online retailer, in a DarkForums thread dated 24-08-2026. Admin access to a live storefront enables customer-data theft, web-skimming injection and defacement, and is a concrete initial-access sale rather than generic chatter. It is worth surfacing as a real access offer even though the victim is outside LATAM.Access sale● 70
Venta de SSRF zero-day en base de datos de ciudadanía gubernamentalA seller is advertising a zero-day SSRF vulnerability granting full PII access to a government citizenship database (domain suffixed '.gov.xx'), keeping the exact country concealed. If genuine, it enables wholesale access to national identity records, fueling mass identity fraud, targeted phishing and espionage. Defenders should treat citizenship and identity registries as top-priority attack surface and validate externally exposed endpoints.Access sale● 50
Venta de acceso de administrador al instituto educativo indio Amritsar InstitutesA threat actor is selling administrative access to the Amritsar Institutes education portal (amritsarinstitutes.com) in India, including the principal/admin account. With admin control an attacker could alter records, deface the site or pivot into connected systems. Institutions holding personal data should rotate credentials and audit access logs.Access sale● 44
Credenciales de administrador de WordPress a la ventaA seller is distributing verified WordPress administrator credentials harvested from stealer logs, offering direct CMS takeover of affected sites. Compromised WordPress admin access enables webshell deployment, defacement, SEO poisoning and hosting of malware or phishing pages. Defenders should hunt for the listed credentials in their sites, force password resets and review admin accounts and plugins.