BRIEFAccess salehighP58
Access to Madagascar's official SSO staging environment for sale
Gobierno de Madagascar (SSO oficial)
Detected22 October 2026 · 02:36 UTC
A threat actor is selling access to a staging environment linked to Madagascar's official single sign-on service. Staging SSO tenants routinely mirror production identity configuration, test accounts and integration secrets, so a buyer gains a realistic path into government authentication infrastructure. Even though the target is outside Latin America, it is a concrete named government access sale rather than generic chatter and warrants tracking for credential reuse.
CategoryAccess sale
Severityhigh
Priority score58
Detected22 October 2026 · 02:36 UTC
Access sale● 62
Venta de acceso al entorno SSO de un organismo oficial de MadagascarA seller is offering access to the staging SSO environment of Madagascar's official government portal, which can expose authentication infrastructure and test credentials. Staging environments often mirror production identity systems, enabling lateral movement into citizen-facing services. Sale of government identity access is high-value for follow-on intrusions.Access sale● 58
Acceso al SSO oficial de Madagascar en venta (staging)A seller offers access to the staging environment of Madagascar's official national single-sign-on (SSO) system. Government authentication infrastructure is high value, and staging access can expose configurations, test credentials and paths into production. A genuine access-sale lead against a national government identity system.Access sale● 38
Lista de 64.000 accesos de correo corporativo a la ventaA freshly posted list of roughly 64,000 corporate business email credentials is circulating. These valid mail-access combos enable credential stuffing and business email compromise across many companies. Not tied to a specific public-sector victim, but useful for defenders to hunt for reused corporate passwords.Access sale● 38
Oferta de acceso root a servidores sin víctima identificadaA DarkForums marketplace seller posted 'root access' to servers with an 11M figure about eight hours ago, but the listing names no victim, sector or geography. Unattributed root-access offers are usually reposts or resold access rather than fresh intrusions, so value is limited until a target appears. Monitor the thread for samples or a named organisation.Access sale● 42
Venta de acceso RDP con privilegios de administradorA seller on BlackBones is advertising RDP access with administrative privileges, a common initial-access vector for network intrusion and ransomware staging. No specific victim or geolocation is named, so the direct exposure is unknown, but buyers of such access typically use it for lateral movement and data theft. Defenders should treat admin RDP as a high-value foothold and enforce MFA, restrict RDP exposure and monitor for credential reuse.Access sale● 62
Venta de acceso a la base de datos de NIO Power en ChinaA seller is offering access to NIO Power China's database containing user information such as phone numbers and addresses. NIO Power runs EV battery-swap and charging infrastructure, so customer and location records are tied to mobility operations rather than a generic webshop. The data supports phishing, physical tracking and further intrusion attempts against the operator's suppliers.