BRIEFAccess salelowP28
API keys and initial access shop on LeakForum
Detected28 October 2026 · 21:24 UTC
A secondary seller on LeakForum advertises an 'API Key Shop' offering API keys and initial access, indicating resale of cloud and service credentials used as intrusion footholds. The ad is dated March 2025, so it is stale and not a fresh alert, but it reflects an active initial-access brokerage channel worth monitoring.
CategoryAccess sale
Severitylow
Priority score28
Detected28 October 2026 · 21:24 UTC
Access sale● 50
Venta de acceso a la infraestructura interna de Epic GamesA user on BreachForums advertised "EPIC GAMES ORG ACCESS" on 28 October 2026, claiming organisational access to the game publisher's environment. The post does not state the access vector, but sales of this type typically involve VPN, SSO or CI credentials and are frequently gateways to supply-chain attacks on game studios. Epic Games also operates payment and account infrastructure, making the claim worth validating quickly.Access sale● 30
Venta de exploits 0day y 1day para VPN SSL en foro clandestinoA seller on Niflheim is advertising SSL VPN exploits, both 0-day and 1-day, without naming any product or victim. There is no specific target, sample, or pricing detail, so this is exploit-brokerage marketing rather than a confirmed access sale. It still matters modestly because SSL VPN appliances are the most common initial-access vector into government and critical-infrastructure networks, and fresh exploit availability shortens patch windows.Access sale● 35
Venta de exploit RCE 0day para equipos Calix GPONA seller on BreachForums offered a pre-authentication RCE 0day for Calix GPON, hardware widely deployed by fiber ISPs. It could let an attacker take over optical line terminals and disrupt or intercept broadband traffic. The thread dates to March 2025, so treat it as stale vulnerability intel rather than a fresh alert.Access sale● 45
Ministerio del Interior de Camboya (gov.kh): datos a la ventaAn actor is advertising data or access tied to Cambodia's Ministry of Interior (interior.gov.kh), a sensitive law-enforcement ministry. Government ministry access carries high value for espionage and downstream attacks. The details are behind a login wall and the scale and date are unconfirmed, so it warrants verification rather than immediate alarm.Access sale● 55
Venta de acceso a panel de administrador de Vijaysales con 3M de registrosA PwsForums seller is offering 3M+ records plus 'super administrator panel' access to Indian retailer vijaysales.com, dated October 2026. This combines bulk customer data with privileged control of the web platform, enabling further data theft or malicious modification. Retailers using similar e-commerce stacks should review admin access controls and session hygiene.Access sale● 38
Publicación gratuita de accesos root a paneles cPanel/WHMThe actor 'ROOT SYSTEM' published a free 'community drop' of cPanel/WHM root-level access on the DarkNetArmy forum within the last hour, freshly posted today. Even without named victims, bulk root access to hosting panels lets attackers deface sites, deploy phishing, or reach the mail, databases and billing of every account on the affected servers. Because the access is being given away, exposure is likely to spread quickly to low-skilled actors, so hosting providers should hunt for unauthorized cPanel logins now.