BRIEFAccess salehighP50
Webshell with WordPress admin panel access for sale
Detected3 October 2026 · 21:55 UTC
A seller on the Spear forum, posting within the last hour, is offering a webshell with WordPress administrator panel login. Though no victim is named, such access sales let buyers deface sites, deploy web skimmers or pivot into hosting infrastructure. WordPress admin access should trigger immediate hunting for unauthorized shells.
CategoryAccess sale
Severityhigh
Priority score50
Detected3 October 2026 · 21:55 UTC
Access sale● 58
Base de datos de 838 GB y acceso FTP de dmp.com.tw a la ventaA seller is offering an 838 GB database from the Taiwanese firm dmp.com.tw together with live FTP server access. Live FTP credentials are a direct intrusion vector enabling data theft, defacement or lateral movement. Buyers of such access should be treated as an active threat to that network.Access sale● 35
Venta de acceso de administrador a la biblioteca vietnamita thuvienonline.com.vnA forum user is offering administrator access to thuvienonline.com.vn, a Vietnamese online library web application. Although low-value, admin access enables data theft, defacement or use of the host as a pivot for further attacks. It is marginal for LATAM/government defenders but illustrates ongoing low-tier access sales worth monitoring.Access sale● 58
Acceso admin de webmail de tienda italiana de alimentos a la ventaA seller on DarkForums is offering administrative webmail access to an Italian food and confectionery online retailer. Webmail admin control lets an attacker read all mail, trigger password resets and mount business email compromise against the company and its partners. Retailers and their supply-chain contacts should rotate mailbox credentials and monitor for suspicious logins.Access sale● 45
Venta de acceso al panel de la tienda aavaz.bizA seller on BreachForums is offering access to the store administrator panel of the e-commerce site aavaz.biz. Control of a store backend typically exposes customer orders, payment data and the ability to plant skimmers or fraudulent checkout logic. Site operators and payment-fraud teams should audit admin credentials and access logs.Access sale● 65
Venta de acceso RDP a una gran instalación médica de Arabia SauditaA seller is advertising RDP access to a large medical facility in Saudi Arabia generating $70M-$100M in revenue, indicating a serious network foothold. Initial access like this is typically used for ransomware deployment or data theft, making it a high-value target for buyers. Healthcare defenders should treat such offers as an imminent intrusion signal.Access sale● 76
Venta de acceso VPN Pulse Secure a una firma legal turcaA seller on the Spear marketplace is offering Pulse Secure SSL-VPN access to a legal services company in Turkey with an estimated $1B-$5B revenue. VPN access at this scale typically enables direct entry into corporate networks, lateral movement and ransomware staging. The post is dated 08 Oct 2026, so the access is likely live and actionable for defenders to hunt and remediate.