[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9DSPTO_4MdEGL_nnhRg4aZ2bIsjKJWn3-Czu9zMaZvc":3},{"article":4,"iocs":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"628b719e-eb65-4827-8261-6a3d5abba16e","Alleged Live Access to a Spanish Public-Sector Payroll Portal Offered for Sale","alleged-live-access-to-a-spanish-public-sector-payroll-portal-offered-for-sale-79951a","A threat actor using the alias kr0x6 claims to hold live access to an administrative portal of an unnamed Spanish public-management entity, covering 371 accounts where employee bank details for payroll deposits can allegedly be modified.","A threat actor using the alias kr0x6 is allegedly offering live access to an administrative portal belonging to an unnamed Spanish public-management entity on the dark web. The compromised system reportedly provides access to 371 employee accounts with the ability to modify bank details tied to payroll deposits. This represents a significant risk to both the organization and its employees, who could be targeted for financial fraud.","Threat actor kr0x6 claims to offer live access to Spanish public-sector payroll portal covering 371 employee accounts.","Initial Access Alleged Live Access to a Spanish Public-Sector Payroll Portal Offered for Sale , and Dark Web Informer May 26, 2026 . 5:01 PM 12 min read 𝕏 Share on Facebook Share on Pinterest Share on LinkedIn Share on WhatsApp Share via Email ▣Post details !Allegedly exposed ◱Screenshot ⚠Potential impact iStatus ✕ Related Initial Access Colombian BPO ContactMaster BPO Listed in Alleged Access Sale Tied to Claro Móvil Colombia , and Dark Web Informer May 25, 2026 Paid Members Public Initial Access Swiss Parking Platform Parkingpay Listed in Alleged 2.8M-Record Data Sale , and Dark Web Informer May 24, 2026 Paid Members Public Initial Access Threat Actor 0056113 Selling Compromised Law-Enforcement Emails and EDR-as-a-Service for Fraudulent Emergency Data Requests , and Dark Web Informer April 29, 2026 Paid Members Public Initial Access Threat Actor Selling Root RCE Shell Access to Botswana Government Health Portal Firewall for $300 , and Dark Web Informer April 7, 2026 Paid Members Public Latest Vulnerabilities Root in One Request: Pre-Auth RCE in Marimo (CVE-2026-39987) , and Dark Web Informer May 29, 2026 Paid Members Public Data Breaches Argentine Healthcare Provider Swiss Medical Listed in Alleged 458K-Record Member Data Sale , and Dark Web Informer May 29, 2026 Paid Members Public Leaks French Real-Estate Co-op Platform Amepi Hit by Alleged 6K-Record Leak , and Dark Web Informer May 29, 2026 Paid Members Public Articles Daily Dose of Dark Web Informer - May 28th, 2026 , and Dark Web Informer May 28, 2026 Paid Members Public","https:\u002F\u002Fdarkwebinformer.com\u002Falleged-live-access-to-a-spanish-public-sector-payroll-portal-offered-for-sale\u002F","https:\u002F\u002Fstorage.ghost.io\u002Fc\u002F6b\u002F16\u002F6b16ac9c-cd67-432f-b0f3-bbec941084ff\u002Fcontent\u002Fimages\u002F2026\u002F05\u002F19785461928746987523698762598762-1.png","2026-05-26T17:01:25+00:00","2026-05-26T18:00:11.195+00:00",7,[18],{"name":19,"type":20},"kr0x6","threat_actor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":21,"icon":23,"name":24,"slug":25},null,"Breaches","breaches",[27,32,37],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":33},{"id":34,"icon":23,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":38},{"id":39,"icon":23,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]