Our Analysts Found the ARCEUSULP 153 Combolist With 370,130 Logins

HEROIC analysts found a combolist named ARCEUSULP 153 circulating on a Telegram channel as of July 28, 2026. The file contained 370,130 records made up of email addresses, plaintext passwords, and the URLs those credentials were used on, making it a sizeable dump for a Telegram-distributed file. Why This Is Dangerous: Because the passwords in ARCEUSULP 153 are stored in plaintext and organized as ready-to-use email and password pairs, an attacker does not need any technical skill to use them. They can load the file straight into automated login tools and start testing credentials against real websites within minutes. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each set of credentials Why This Matters: With 370,130 working logins in one file, ARCEUSULP 153 is exactly the kind of dataset used for large-scale credential stuffing, where attackers automatically test stolen email and password pairs against banking, email, and shopping sites. If you have ever reused a password, a leak of this size significantly increases your odds of becoming a target for account takeover, financial fraud, or identity theft. How a Combolist Like This Works: A combolist is built by combining email and password pairs gathered from previous breaches, stealer logs, or phishing campaigns into one large file. Unlike a raw malware log, combolists are often filtered and organized so that a higher share of the credentials still work, which is part of why files like ARCEUSULP 153 circulate widely on Telegram, where they can be downloaded and put to use by attackers almost immediately. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including large combolists like ARCEUSULP 153, so you can find out in seconds if your credentials were exposed. Run a free scan today and change any password you've reused across multiple sites.