Researchers Link the Berserk Combolist to 1,091 Exposed Logins

HEROIC analysts identified a combolist called "Berserk" that a Telegram user uploaded on October 25, 2025. The file contains 1,091 records pairing email addresses with plaintext passwords, along with the URLs where each credential pair was meant to be used. Every password in the file is stored without encryption, meaning it can be used immediately by anyone who obtains it.

Why This Is Dangerous

With over a thousand plaintext email and password pairs in one file, an attacker has a ready-made list to test against websites in bulk. There is no cracking step involved: the credentials work as-is. Anyone whose information appears in the Berserk file is at immediate risk if they reused that password anywhere else.

What Was Exposed in the Berserk Leak

• Email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters

Files like the Berserk combolist are used in credential stuffing attacks, where automated tools rapidly test stolen email and password pairs against banking sites, email providers, and social media platforms. Because so many people reuse passwords, a single exposed credential can lead to account takeover well beyond the original source, opening the door to identity theft and financial fraud.

How a Combolist Leak Works

A combolist combines usernames or emails with passwords, usually gathered from previous breaches, phishing campaigns, or malware that steals saved browser logins. Assembling one doesn't require hacking any specific company. It only takes someone collecting and sharing credentials that are already circulating, which is how the Berserk file came to be uploaded on Telegram.

Check If You Are Affected

Don't wait to find out if your credentials are part of the Berserk leak. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like this one, so you can quickly see if you were affected and take steps to secure your accounts.