The Fehu ULP Dump: 18.6 Million Login Credentials Hit the Dark Web

HEROIC analysts identified a combolist uploaded to a Telegram channel on 17 October 2025 containing 18,586,154 records of email addresses, plaintext passwords, and associated URLs. The file, referred to in dark web circles as "Fehu," compiles login credentials into a single searchable list built for account takeover attempts, and it is now circulating freely among threat actors.

Why the Fehu ULP Dump Is Dangerous

A combolist like this pairs a username or email address directly with a plaintext password, and often a URL showing which site the login belongs to. That combination is exactly what automated attack tools need. An attacker does not have to guess anything or crack any encryption. They can load the list straight into a credential-stuffing tool and start testing those email-and-password pairs against banking sites, email providers, and social media platforms within minutes.

What the Fehu Combolist Exposed

• Email addresses tied to real user accounts
• Plaintext passwords, stored and shared without any encryption
• URLs identifying which websites or services each login was used on

Why This Matters If You Reuse Passwords

Most people use the same password, or a close variation of it, across several accounts. If your email and password appear in the Fehu dump, any account that shares that password is exposed, not just the one the credentials were originally collected from. This is how a single leaked login turns into a compromised email account, a hijacked social media profile, or a drained financial account. Attackers automate this process at scale, so the window between a leak surfacing and it being tested against major platforms is often just hours.

How This Combolist Was Assembled

Combolists like Fehu are typically built by merging credentials pulled from older breaches, phishing campaigns, and malware infections into one large text file, then cleaning and deduplicating the entries so they are easier to use. They are prized in criminal marketplaces precisely because they are ready to use out of the box. No hacking skill is required to weaponize one, which is why files like this spread quickly once they hit Telegram.

Check If You Are Affected

With 18,586,154 records now public, the odds that your email address is included are real. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this one, so you can find out in seconds whether your credentials were part of this dump and take action before someone else uses them.