How Malware Led to 35,607 Stolen Logins in the UHQ Mixed Combo

In January 2023, HEROIC's threat intelligence team intercepted a stealer log file titled "36K UHQ Mixed Combo Good Hits" on Telegram. The "UHQ" designation stands for "Ultra High Quality," a term used in cybercriminal marketplaces to indicate that the 35,607 credentials inside have been tested and verified as working. Each record contains an email address, a plaintext password, and the URL of the service from which it was stolen — making this one of the more dangerous credential files in recent circulation.

What "Ultra High Quality" Means for Your Security

When a credential dump is labeled UHQ, it means the threat actor has already filtered out dead accounts, changed passwords, and expired logins. What remains are 35,607 credentials that were recently confirmed to grant access to real accounts. The plaintext passwords require no cracking — they are readable strings that work immediately. This pre-verification process means the file has a dramatically higher success rate than raw, untested dumps, making it exceptionally valuable to attackers.

What Was Exposed

• Email Addresses — a mixed collection spanning multiple providers, platforms, and services
• Plaintext Passwords — verified as working and stored without any encryption
• URLs — the login endpoints where each credential was originally captured by malware

Mixed Combos Maximize Credential Stuffing Damage

A "mixed combo" draws credentials from many different services rather than targeting a single platform. This diversity makes it ideal for credential-stuffing campaigns that test each pair across banking, email, social media, streaming, and cloud services simultaneously. The 35,607 email-password pairs in this file can be loaded into automated tools that check hundreds of websites per minute. For users who reuse passwords, a single entry in this combo could unlock access to a dozen different accounts.

Tracing the Path from Malware Infection to UHQ Combo

Every credential in this file started as a saved password in someone's browser. Infostealer malware — variants like RedLine, Vidar, Lumma, or Raccoon — infected the victims' devices through phishing links, malicious ads, or trojanized software. The malware extracted all stored credentials, cookies, and autofill data, then transmitted them to a command-and-control server. The raw data was then sorted, deduplicated, validated against live services to confirm each login still works, and finally packaged as a "UHQ" collection for sale and distribution on Telegram.

Check If Your Credentials Were Exposed

With over 35,000 verified credentials in this single file, the risk of your data being included is real. HEROIC's data breach scanner searches across more than 400 billion compromised records to reveal whether your email or password appears in the UHQ Mixed Combo or any other known leak. Because these credentials have been verified as working, speed matters — check now and change any exposed passwords before attackers use them.