BRIEFAccess salelowP48
Web shell access to compromised servers for sale (10x batch)
Detected12 September 2026 · 16:12 UTC
A seller is offering a batch of 10 freshly compromised web shells, granting remote code execution on the underlying servers without needing an exploit chain. No specific victim is named, but web shells are a common foothold used to pivot into hosting providers and their downstream customers. Defenders should hunt for unauthorized webshell artifacts and suspicious outbound callbacks.
CategoryAccess sale
Severitylow
Priority score48
Detected12 September 2026 · 16:12 UTC
Access sale● 22
Venta de lote de 130 accesos root y admin de cPanel/WHMCSA seller lists 130 cPanel/WHMCS accounts with root, admin or user-level access, which would let buyers seize control of hosted websites and mail. This access type is a classic stepping stone to mass website compromise, credential theft and spam infrastructure. The post appears to date to 2022 and is stale, but affected hosts may still be vulnerable if credentials were never rotated.Access sale● 78
Acceso admin y defacement de la Universidad César Vallejo (Perú)Threat actor Keishell posted admin-level access to ucv.edu.pe, the Universidad César Vallejo in Peru, along with a website defacement, claiming over 200,000 students affected. This exposes student PII, staff credentials and internal systems to further intrusion or fraud. A large Latin American university is a valuable target for both data theft and reputational disruption.Access sale● 74
Venta de acceso de administrador a la infraestructura FTTH/GPON del ISP AlfatihnetA seller is offering administrative access to the FTTH/GPON infrastructure of ISP Alfatihnet, i.e. management control of a telecom operator's access network. Compromise of an ISP access layer enables traffic interception, subscriber data theft and mass service disruption across all customers. Telecom operators should verify and rotate credentials on exposed management interfaces immediately.Access sale● 66
Venta de acceso admin a plataforma internacional de apuestasA seller on BreachForums is offering administrative access to a major international sportsbook platform. Admin-level access to a betting platform enables mass account manipulation, fraud, and theft of customer funds and data. Such access is time-sensitive and typically monetized quickly, so defenders in gaming and finance should treat it as actionable.Access sale● 50
Venta de datos bancarios y credenciales de Color Communications LLCA carding-forum listing offers bank account data, check images, and login credentials belonging to Color Communications LLC, a named corporate victim. If genuine, the material enables direct account takeover and fraudulent payments against the company. Defenders should corroborate with the organization and monitor for fraudulent transactions and credential misuse.Access sale● 46
Exposición de API ugdpay y Jenkins del portal digital.gov.mgCredentials and configuration for the ugdpay payment API and a Jenkins CI server on Madagascar's digital.gov.mg portal were posted on a criminal forum. Exposed CI/CD and payment-API access can let an attacker pivot into government infrastructure or manipulate transactions. It should be treated as a live initial-access opportunity against a national government system.