VirusTotal Plataforma VirusTotal · Breach

Actor sells VirusTotal Enterprise upgrades using alleged administrator access

Oct 29, 2026 · 1 min read

Actor Zerrix advertises upgrades of personal VirusTotal accounts to Enterprise for $800 in cryptocurrency, claiming access to a group administrator account. The service promises file downloads, advanced search, a private API key, Retrohunt, and Livehunt. The claim is unverified; review your group permissions and API keys.

By HIFY Radar newsroom Updated 10/29/2026 10:43 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An actor known as Zerrix offers to upgrade personal VirusTotal accounts to the Enterprise plan for $800 in cryptocurrency. The actor claims access to a group administrator account. The claim is unverified.

Why it matters

If the access exists, paid Enterprise capabilities such as suspicious file downloads and a private API key would be sold outside any contract. Companies relying on VirusTotal for security work should consider the risk of account manipulation and misuse of analysis data.

What to do

Review company VirusTotal accounts and groups for unexpected plan, permission, or API key changes. Confirm who the group administrators are and monitor key usage. Treat the case as a claim until official confirmation.

For the technical team

Affected: VirusTotal Plataforma VirusTotal; alegado acesso de administrador de grupo usado para elevar contas pessoais a Enterprise · VirusTotal platform, group account model, and personal accounts that can be upgraded to Enterprise. No affected versions cited.
Exploitation: No confirmed exploitation and no independent verification. The advertisement was reported by DarkWebInformer; actor Zerrix's claim remains unverified.
Fix: No fix applicable, as no confirmed flaw exists. Mitigation: audit group administrators, permissions, and API keys on the organization's VirusTotal accounts.
Vector: Alleged target: a VirusTotal group administrator account, used to upgrade personal accounts to the Enterprise plan. The source does not describe how the access was obtained. No specific technical vulnerability is cited.
More details: Actor: 'Zerrix'. Advertised price: $800 in cryptocurrency. Promised features: file downloads, advanced search, a private API key, Retrohunt, and Livehunt. The actor claims the upgrades avoid risks from leaked API keys or compromised accounts. Single source: DarkWebInformer on X.