BRIEFAccess salehighP52
Admin access to Pakistani site Pomilights.pk for sale
Pomilights.pk
Detected21 September 2026 · 14:37 UTC
A threat actor is selling administrator-level access to Pomilights.pk, a Pakistani online retailer, in a DarkForums thread dated 24-08-2026. Admin access to a live storefront enables customer-data theft, web-skimming injection and defacement, and is a concrete initial-access sale rather than generic chatter. It is worth surfacing as a real access offer even though the victim is outside LATAM.
CategoryAccess sale
Severityhigh
Priority score52
Detected21 September 2026 · 14:37 UTC
Access sale● 55
Venta de acceso completo a la infraestructura de un editor de juegos móvilesA DarkForums seller is advertising full access to a mobile game publisher's infrastructure in the Access Market section, currently open on the forum. Full-infrastructure access typically means domain, cloud or CI/CD control, giving a buyer the ability to push malicious updates to end users. The victim is unnamed but the offer is time-sensitive because such listings usually sell within days.Access sale● 66
Credenciales de usuarios de CLARU Perú publicadas en DarkForumsA DarkForums actor using the handle z4p3r0c0 posted a set of user accesses for CLARU Perú on 5 November 2026. Although the volume is not stated in the snippet, leaked account credentials for a Peruvian service let attackers attempt account takeover and credential stuffing against linked platforms. Peruvian organisations and customers of the platform should treat these credentials as compromised and rotate them.Access sale● 54
3.500 credenciales válidas de Itaú Brasil verificadas a la ventaA fresh DarkNetArmy post by SUB-ZER0 offers about 3,500 validated usernames linked to itau.com.br, part of the same batch as larger Caixa and Nubank listings. The volume is modest but targets Brazil's largest private bank, where even a few valid accounts can enable fraud or abuse of online banking portals. It should be read as a signal of active credential harvesting against Brazilian financial institutions.Access sale● 79
15.000 credenciales válidas de Caixa (caixa.gov.br) a la ventaSUB-ZER0 listed roughly 15,000 valid, checked usernames tied to caixa.gov.br on DarkNetArmy, posted within the last half hour. Caixa is Brazil's state-owned federal bank, so verified account pairs enable account takeover, fraud against benefit payments and lateral abuse of internal portals. The seller claims the credentials were validated, which raises the likelihood of immediate exploitation.Access sale● 62
Venta de acceso a empresa de VFX de EE. UU. con ingresos de 202 M$An actor on the Pwn Forum is advertising initial access to a US visual-effects company reportedly generating $202M in revenue. The listing sits behind a login wall, so the access vector, price and proof are undisclosed, but access to a firm of this size could enable ransomware deployment or large-scale data theft.Access sale● 72
Datos de 656.000 personas y acceso al sistema de la Universidad de Hong KongA DarkForums listing claims 656,000 personal records from Hong Kong Metropolitan University plus access to its internal systems, combining a bulk data leak with a network foothold. University systems hold student, staff and research data, and access sales often precede ransomware or further intrusions against academic and public institutions in the region. The post date and proof samples were not visible, so recency and authenticity still need confirmation before escalation.