COMBOLIST 2M USA MIX FRESH 100: Bigger Than Dallas in Stolen Records

In December 2025, HEROIC analysts identified a stealer log file circulating under the name COMBOLIST 2M USA MIX FRESH 100, uploaded to a Telegram channel by an individual user. The file contains 1,972,477 records tied primarily to United States based accounts, pairing email addresses with plaintext passwords and the exact website URLs those logins unlock.

Why This Stealer Log Puts USA Accounts at Risk

What makes this dump especially dangerous is that it does not just list stolen passwords, it lists them alongside the login page they belong to. Instead of guessing which site a password might work on, an attacker can open the URL, drop in the matching email and password, and be logged in within seconds. There is no cracking, no decryption, and no guesswork involved because the passwords were captured in plaintext directly from infected devices.

What the COMBOLIST 2M USA MIX FRESH 100 Leak Contains

• Email addresses used as account usernames
• Plaintext (unencrypted) passwords
• The specific login URLs each credential pair works on

Why This Matters If You Reuse Passwords

Nearly 2 million matched login pairs is more than enough raw material for large scale credential stuffing attacks, where automated tools test the same email and password combination against banking, email, retail, and social media sites. If you have ever reused a password across more than one account, a single exposed pair from this leak could open the door to account takeover, identity theft, or direct financial fraud on accounts that were never part of the original breach.

How Stealer Log Malware Builds Combolists Like This One

Stealer logs like this one come from infostealer malware, malicious software that quietly infects a device through a fake download, cracked software, or phishing link. Once installed, it scans the browser for saved passwords, autofill data, and session cookies, then quietly sends everything back to the attacker. Criminals collect thousands of these individual infections and merge them into a single combolist, which is then packaged, labeled (as with the "FRESH 100" tag here signaling a recent batch), and sold or shared in Telegram channels like the one where this file surfaced.

Check If Your Email Appears in This Stealer Log

With 1,972,477 records already circulating, the safest move is to find out directly whether your information is part of it. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including stealer logs like this one, so you can see your exposure and take action before someone else uses your credentials first.