Credential Stuffing Exposed 118 Facebook Accounts Online

HEROIC's threat research team identified 118 FaceBook Accounts, a combolist shared on Telegram on December 15, 2022. The file contains 118 records pairing email addresses with plaintext passwords and the web addresses those credentials unlock.

Why This Is Dangerous

Lists like this one are usually built through credential stuffing: an attacker takes email-and-password pairs leaked elsewhere and tests them against a specific platform, in this case one tied to Facebook logins. The 118 records that worked get compiled into a fresh, ready-to-use file, meaning every entry here is a login that has already been verified as active.

What Was Exposed

Inside the 118 FaceBook Accounts File

• Email addresses
• Plaintext passwords
• The login URLs tied to each credential pair

Why This Matters

• Account takeover: A verified working login means an attacker can access the account immediately, no guesswork involved.
• Social engineering: Access to a Facebook-linked account can be used to impersonate the victim and target their friends and family.
• Credential stuffing elsewhere: The same email-and-password pair is often tested against email, banking, and shopping accounts too.

How Combolist Attacks Work

Combolists are compiled, not stolen in a single hack. Criminals pull email-and-password pairs from older breaches, stealer log malware, and other leaked databases, then test them in bulk against a target platform using automated tools. Whatever succeeds gets filtered into a smaller, verified list like this one, then shared for free or sold in Telegram channels and dark web forums.

Check If You Are Affected

You don't have to guess whether your information is part of a leak like this one. HEROIC's free breach scanner checks your email address against a database of more than 400 billion compromised records, including combolists, stealer logs, and confirmed corporate breaches. If a match turns up, HEROIC will show you exactly what was exposed and walk you through the steps to secure your accounts.