Combolist USA Fresh: 764K Logins Across Multiple Sites

HEROIC analysts identified a stealer log dump, labeled "COMBOLIST USA FRESH," posted to a Telegram channel on October 21, 2025. The file contains 764,313 records, each pairing an email address with a plaintext password and the URL of the account the credential unlocks. Unlike a breach tied to a single company, a "combolist" like this one pulls together credentials from many different websites and services, all bundled around a common thread, in this case, accounts believed to belong to people in the United States.

Why This Is Dangerous

Because the passwords in this file were captured in plaintext directly from infected devices, an attacker does not need to crack or guess anything to use them. Each record already links an email, a password, and the exact site it unlocks, spanning whatever mix of banking portals, shopping accounts, email providers, and other services the original victims had saved logins for. Combolists like this one are especially attractive to attackers because the sheer variety of sites represented means almost any kind of account could be exposed.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites where the credentials were used

Why This Matters

With 764,313 records spanning a wide mix of sites, this combolist gives attackers a broad target list for credential stuffing, automatically testing each stolen email and password against banking, retail, and email platforms to see which ones still work. Because the list crosses so many different services rather than a single industry, the fallout can range from drained shopping accounts and hijacked email inboxes to full identity theft, depending on which accounts each victim had tied to the leaked password.

How Stealer Logs Work

Stealer logs are produced by infostealer malware, which infects a device, often through a pirated download, cracked software, or malicious attachment, and then quietly harvests saved passwords, autofill data, and browsing history from the victim's browser. When sellers combine many individual logs into one large file spanning multiple websites and services, the result is often marketed as a "combolist," a term used in stolen credential markets to describe a mixed collection sorted loosely by country or freshness, as reflected in this file's "USA Fresh" label. These combolists are then distributed through Telegram channels dedicated to trading stolen login data.

Check If You Are Affected

If you want to know whether your email or passwords appear in this combolist or others like it, HEROIC's free breach scanner checks your details against a database of more than 400 billion leaked records. It only takes a moment to search and can help you catch an exposed account before someone else does.