BRIEFAccess salehighP72
Root SSH and live SMTP access to Australian consultancy with 263k invoices
Australian consulting firm (ERP/CRM provider)
Detected15 November 2026 · 15:14 UTC
A seller on BreachForums offers full access to an Australian consulting firm's ERP/CRM, including root SSH, a live SMTP server and roughly 263,000 invoices ready for business email compromise. That blend of infrastructure control and invoice data enables invoice fraud and mass phishing against the firm's clients. The affected vendor and its enterprise customers should verify exposure urgently.
CategoryAccess sale
Severityhigh
Priority score72
Detected15 November 2026 · 15:14 UTC
Access salePriority 36
Venta de acceso de usuario al sitio anglocursos.com.brA threat actor using the handle SebastianDar is selling user access to anglocursos.com.br, a Brazilian language-learning website, on DarkForums in a post dated November 15. The offer appears to involve unauthorized account access to the platform rather than a large database dump. It is a lower-impact but regionally relevant access sale that could enable abuse of user accounts and the platform's infrastructure.Access salePriority 68
Venta de acceso Domain Admin a una red corporativa no identificadaA seller on BreachForums is offering Domain Admin and domain controller access to an unnamed corporate network together with 2.7 GB of collected data. Domain-level access allows ransomware deployment and mailbox or file-share exfiltration across every joined host. The victim is not named, but the listing indicates an active, still-unsold intrusion.Access salePriority 82
Venta de acceso a corporación sudamericana de US$10-30 millonesA seller on DarkForums is offering access to a South American corporation with estimated revenue of $10-30M, a high-value corporate intrusion pitched to cross-border buyers. The exact victim, access method and privileges are not disclosed, but the offer could enable ransomware or fraud. Regional enterprises should verify external exposure and monitor for credential abuse.Access salePriority 85
Venta de datos del Ministerio de Relaciones Exteriores de BoliviaA seller on BreachForums is advertising material tied to Bolivia's Ministry of Foreign Affairs, a national government body handling diplomacy and consular affairs. Any leak or access sale of a foreign ministry exposes diplomatic communications, citizen passport/consular records and staff credentials, raising risks of targeted phishing and state-adjacent espionage. Defenders in Bolivia's public sector and neighboring LATAM ministries should treat this as a priority governance and data-protection incident.Access salePriority 84
Venta de acceso a la Policía Civil de BrasilBreachForums seller bl33dr00t is advertising access or data linked to a Brazilian Civil Police agency in a thread posted in mid-November 2026. Law-enforcement records and access to police systems are among the most sensitive targets, enabling doxxing of officers, tampering with investigations and lateral movement into government networks. The offer is recent and needs urgent verification by the affected agency.Access salePriority 32
Plataforma india de cripto cryptocollect.in comprometidaA DarkForums marketplace listing advertises the compromise of cryptocollect.in, an Indian crypto collection platform, likely offering stolen data or access. Crypto payment platforms hold wallet and customer records whose leakage enables fraud and account takeover of investors. The listing provides no sample or scope, so it is a low-confidence, low-scale claim worth only monitoring.