7,809,738 Plaintext Passwords Leaked in FROST TXT LOG 167

In November 2025, HEROIC analysts identified FROST TXT LOG 167, a combolist file uploaded to a Telegram channel that exposed 7,809,738 records, each pairing an email address with a plaintext password and a web address. With the passwords stored in plaintext, anyone who has this file can read them instantly, which is why scanning your email is the only reliable way to learn if you were caught up in it.

Why This Is Dangerous

Because these passwords require no cracking, they can be tested against other websites almost immediately after the file circulates. People who reuse the same password on more than one site are the most exposed, since a single leaked credential pair can be enough to unlock an unrelated account elsewhere.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs

In practice, files like this one feed automated login attempts across email, streaming, retail, and financial sites, since scripts can work through millions of pairs far faster than any person could. The attached URLs point attackers straight at the correct login page for each credential, which speeds up account takeover attempts significantly.

A combolist is typically assembled from many separate credential leaks and infections rather than one single company's breach, then packaged together and shared through channels like this one. That patchwork origin is part of why the same file can quietly touch accounts across dozens of unrelated services at once, spanning people who have no connection to one another beyond a shared reused password.

Check If You Were Caught Up in This Leak

Scan your email to see if it appears in this file. If it does, change that password on every account where you used it, and set up two-factor authentication on your most important logins first.

This applies equally to personal and work email addresses caught up in the same file.