1.9KK PayPal USA Combolist Targets 1.8M Account Holders

On February 25, 2023, a combolist labeled "1.9KK USA MIX PayPal Base UHQ Private 80" appeared on a Telegram channel, exposing 1,838,139 records. Despite the name promising 1.9 million entries, the real file contains 1,838,139 email addresses, plaintext passwords, and URLs, most pointing to PayPal login pages, all pulled from malware-infected devices rather than from PayPal's own systems.

Important: This Is Not a PayPal Data Breach

PayPal did not lose this data. The credentials in this file were stolen directly from infected computers and phones through stealer malware that recorded saved passwords and the exact sites they unlocked. Criminals label these files by the service they're aimed at, in this case PayPal accounts belonging to US users, to make them easier to market to buyers looking for a specific kind of target.

Who's Actually at Risk

Anyone whose device was infected with stealer malware and who had saved PayPal login details in their browser is potentially in this file. Because the list is filtered specifically to US-based PayPal users, it's a highly targeted resource for anyone trying to commit financial fraud, and it's far more dangerous than a generic email-and-password dump.

What Was Exposed

• Email addresses - the login identifiers linked to each PayPal account
• Plaintext passwords - unencrypted and immediately usable
• URLs - confirming the accounts are tied to PayPal login pages

Why This Matters

A PayPal login paired with a working password is a direct line to someone's money. Attackers use lists like this one for account takeover, unauthorized transfers, and identity theft, often moving fast before a victim notices anything is wrong. Because the passwords are plaintext, there's no cracking involved, just testing the login and taking action.

How Stealer Logs Target Specific Services

Stealer malware captures every saved password and autofill entry on an infected device, along with the URL each one belongs to. Criminals then sort these massive logs by website, pulling out every credential tied to PayPal, banking portals, or other high-value targets and packaging them into focused files like this one. That filtering is what makes "base" files more dangerous and more valuable on criminal marketplaces than an unsorted dump.

Check If You Are Affected

If you've ever saved your PayPal password in a browser on a device that could have been compromised, it's worth checking. HEROIC's free breach scanner searches more than 400 billion leaked records, including targeted stealer logs like this one, so you can see your exposure and secure your account before it's used against you.