Scale Check: Malwarebytes_BF Combolist Holds 111,610 Logins

If your email is among the 111,610 records in the Malwarebytes_BF combolist, it means your email address and password have been packaged into a file built for testing against other websites. HEROIC analysts found this file on Telegram, dated 17 March 2026, pairing each email with a plaintext password and the URL it was tied to. Scan your email to check whether your details are part of the 111,610 affected.

What Being in This File Means for Your Accounts

Being listed in a combolist like this does not mean any single company's systems were broken into. It means your login was pulled together with many others from separate sources into one reusable file, which criminals use to test stolen passwords across unrelated sites.

What the Malwarebytes_BF File Contains

• Email Addresses identify the account and enable phishing follow-up.
• Plaintext Password usable immediately, with no cracking needed.
• URLs show exactly which site or service each login was tied to.

Why Scale Increases the Danger

With over 111,000 records in one file, attackers can automate login attempts at scale rather than testing one account at a time. Anyone who reused this password elsewhere faces a much wider exposure, since the same combination could unlock several unrelated accounts.

How a File This Large Gets Assembled

A combolist like this is built by combining email and password pairs pulled from many earlier leaks and stealer logs into a single file, organized for efficient reuse-testing rather than tied to one specific incident.

What to Do if You Appear in the Malwarebytes_BF File

Scan your email to check your exposure. If you find a match, change that password everywhere it has been reused, and assign each account its own unique password going forward, starting with email and banking logins. Apply the same standard to a work email address as you would a personal one.