BRIEFAccess salehighP72
BLS International databases, source code and SSH keys for sale
BLS International
Detected14 September 2026 · 05:12 UTC
Reposts collapsed2
A seller is offering databases, source code and SSH private keys belonging to BLS International, a visa and passport outsourcing firm handling sensitive identity documents for governments. Compromised source code and SSH keys could enable further intrusion into visa-processing systems and expose applicant PII. High-value target for identity theft and government service abuse.
CategoryAccess sale
Severityhigh
Priority score72
Detected14 September 2026 · 05:12 UTC
Access sale● 60
Venta de acceso a la web de la policía de Rajastán (India)A forum user posted a sales thread for access to the Rajasthan Police website, a state law-enforcement body on a .gov.in domain. Although outside the Latin America region, sale of access to a police portal implies web-shell, panel or credential compromise of a government system that holds citizen complaints and case data. Details are behind a login wall, so verification of the level of access is needed before acting.Access sale● 62
Acceso al portal de la Policía de Rajasthan (police.rajasthan.gov.in) a la ventaA verified seller on DarkForums is offering access tied to police.rajasthan.gov.in, the official portal of an Indian state police force. Access to a law-enforcement web asset can expose internal systems, officer data and citizen records. Any government buyer of such access should be treated as a serious law-enforcement and data-protection risk.Access sale● 50
Venta de acceso a la infraestructura interna de Epic GamesA user on BreachForums advertised "EPIC GAMES ORG ACCESS" on 28 October 2026, claiming organisational access to the game publisher's environment. The post does not state the access vector, but sales of this type typically involve VPN, SSO or CI credentials and are frequently gateways to supply-chain attacks on game studios. Epic Games also operates payment and account infrastructure, making the claim worth validating quickly.Access sale● 28
Venta de claves API y accesos iniciales en LeakForumA secondary seller on LeakForum advertises an 'API Key Shop' offering API keys and initial access, indicating resale of cloud and service credentials used as intrusion footholds. The ad is dated March 2025, so it is stale and not a fresh alert, but it reflects an active initial-access brokerage channel worth monitoring.Access sale● 30
Venta de exploits 0day y 1day para VPN SSL en foro clandestinoA seller on Niflheim is advertising SSL VPN exploits, both 0-day and 1-day, without naming any product or victim. There is no specific target, sample, or pricing detail, so this is exploit-brokerage marketing rather than a confirmed access sale. It still matters modestly because SSL VPN appliances are the most common initial-access vector into government and critical-infrastructure networks, and fresh exploit availability shortens patch windows.Access sale● 35
Venta de exploit RCE 0day para equipos Calix GPONA seller on BreachForums offered a pre-authentication RCE 0day for Calix GPON, hardware widely deployed by fiber ISPs. It could let an attacker take over optical line terminals and disrupt or intercept broadband traffic. The thread dates to March 2025, so treat it as stale vulnerability intel rather than a fresh alert.