ARCEUSULP 156: The Same Combolist Series Leaks 565,097 More Logins

HEROIC analysts identified another combolist in the ARCEUSULP series, this one numbered 156, uploaded to a Telegram channel on July 28, 2026. The file contained 565,097 records made up of email addresses, plaintext passwords, and the URLs those credentials were used on. Why This Is Dangerous: The numbered naming pattern suggests whoever is behind ARCEUSULP is releasing these combolists on a repeating basis, and each new one adds fresh, working email and password pairs to what is already circulating. Because the credentials here are stored in plaintext, an attacker can plug them straight into automated tools without any extra effort. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each set of credentials Why This Matters: A combolist series like this one means the risk is not a single event, it is an ongoing drip of new stolen logins. With 565,097 records in this release alone, attackers have plenty of fresh material for credential stuffing, testing stolen email and password pairs against banking, email, and shopping sites. Anyone who reuses passwords across multiple accounts is at real risk of account takeover, financial fraud, and identity theft every time a new batch like this appears. How a Combolist Like This Works: A combolist is built by combining email and password pairs pulled from earlier breaches, stealer logs, and phishing pages into a single file. Producing them in numbered batches, as appears to be happening with the ARCEUSULP series, lets whoever compiles them release fresh material regularly and keep interest from buyers and other attackers on Telegram. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including large combolists like ARCEUSULP 156, so you can find out in seconds if you are one of the 565,097 people affected. Run a free scan today and change any password you have used more than once.