Check Your Email: COMBOLIST 1M CORP FRESH 100 Exposed 995,164 Records

In January 2026, HEROIC analysts identified a stealer log file circulating under the name COMBOLIST 1M CORP FRESH 100, uploaded to a Telegram channel by an individual user on 8 January 2026. The file contains 995,164 records tagged as corporate accounts, pairing email addresses with plaintext passwords and the exact login URLs those credentials unlock.

Why Corporate Credentials in This Leak Are High Value Targets

The "CORP" label on this file signals that the accounts inside it are tied to workplace logins rather than personal ones, which makes this dump especially attractive to criminals. A single working corporate email and password pair can open the door to company email, internal portals, and cloud tools, giving an attacker a foothold to launch business email compromise scams, steal sensitive files, or move deeper into an organization's network.

What the COMBOLIST 1M CORP FRESH 100 Leak Contains

• Corporate and business email addresses used as account usernames
• Plaintext (unencrypted) passwords
• The specific login URLs each credential pair works on

Why This Matters If You Reuse Passwords at Work

Nearly a million matched login pairs gives attackers plenty of raw material for credential stuffing against corporate email, VPNs, and business software. If an employee reuses a personal password for a work account, or a work password for a personal account, one exposed pair from this leak can lead to account takeover, data theft, or fraud that reaches well beyond a single inbox.

How Stealer Log Malware Builds Combolists Like This One

Stealer logs like this one come from infostealer malware, which infects a device through a fake download, cracked software, or phishing link, often opened on a work laptop or personal device used for both home and office logins. Once installed, it scans the browser for saved passwords, autofill data, and session cookies, then sends everything back to the attacker. Criminals merge thousands of these infections into a single file, label it a fresh batch (the "FRESH 100" tag seen here), and sell or share it through Telegram channels like the one this file surfaced from.

Check If Your Email Appears in This Stealer Log

With 995,164 records already circulating, the safest move is to check your exposure directly, whether the email in question is personal or work related. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including stealer logs like this one, so you can see your risk and act before someone else does.