HEROIC Analysts Found the ULPP Redline_Cl0ud4 Dump: 5.3M Records

In mid-July 2026, HEROIC analysts discovered a large combolist file, named FRESH ULPP 16-4-2026 Redline_Cl0ud4, circulating in a Telegram channel. The file contained 5,332,262 records pairing email addresses with plaintext passwords and the URLs each pair was collected from. Why This Is Dangerous: The file's name references RedLine, a well-known password-stealing malware strain that infects computers and siphons saved browser credentials directly from the victim's machine. Whether or not this specific file was built entirely from RedLine infections, it is formatted and distributed the same way stealer output typically is, as a ready-to-use list of working logins that requires no additional cracking. What Was Exposed: - Email addresses - Plaintext passwords - URLs identifying the site each credential pair belongs to Why This Matters: At over 5.3 million entries, this is one of the larger combolists HEROIC has tracked recently. Attackers run these lists through automated credential stuffing tools that try each email and password combination against banking sites, email providers, and shopping platforms. If you reuse a password anywhere in this list, your other accounts could be at risk of takeover, fraud, or identity theft. How a Stealer Log Combolist Like This Works: Stealer malware infects a device, quietly collects saved usernames and passwords from browsers and apps, then sends that data back to the attacker. Multiple stealer logs are often merged into a single combolist and sold or shared for free on Telegram to build a reputation before being sold on dark web marketplaces. Check If You Are Affected: Use HEROIC's free breach scanner to check your email against more than 400 billion compromised records, including this combolist. A free scan takes seconds and shows you exactly what data of yours has been exposed.