148,841 Passwords From 150K MIX COMBO UHQ Found on the Dark Web

HEROIC analysts identified this stealer log on 03-Jun-2026. The breach exposed 148,841 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as 150K MIX COMBO UHQ.

Why This Is Dangerous

This stealer log contains 148,841 email and password pairs in plaintext format. Because the passwords are unencrypted and immediately ready to use, anyone who downloads this file can attempt to log in to accounts right away. The presence of URLs alongside credentials indicates these were stolen from active browsing sessions, meaning passwords were captured as victims typed them into real websites.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (websites where credentials were used)

Why This Matters

When email addresses and plaintext passwords appear in the same file, hackers can use automated tools to test those credentials across hundreds of websites simultaneously. This technique is called credential stuffing, and it means a stolen password from one service can unlock accounts on banking platforms, shopping sites, and social media if the same password was reused. With nearly 149,000 records in this file, the potential for account takeovers is large.

How a Stealer Log Works

A stealer log is generated by malware that secretly installs itself on a victim's computer. Once active, it records keystrokes, captures saved passwords from web browsers, and collects the web addresses visited during login sessions. All of this data gets packaged into a file that is then uploaded to Telegram channels or dark web forums for other criminals to access and use.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.