The MIX BY MOON Leak Gave Hackers 9.4 Million Passwords to Exploit

HEROIC analysts identified a massive combolist called MIX BY MOON uploaded by a Telegram User, shared on 15-Feb-2025. The file contains 9,435,960 records, pairing email or username with plaintext passwords and the URLs of the accounts each pair unlocks.

Why This Is Dangerous

With 9.4 million plaintext credential pairs in one file, attackers have almost everything they need to go straight after real accounts. There is no cracking, guessing, or extra research required. Each record already tells the attacker the email, the password, and the exact site to try it on, turning this single leak into a ready-made toolkit for account theft at scale.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the affected login pages

Why This Matters

A leak of this size means millions of people are at risk if they have reused a password anywhere else. Attackers can run credential stuffing attacks at massive scale using a file like this, automatically testing each of the 9,435,960 email and password pairs against banking, email, and shopping sites. A single successful match can lead to account takeover, financial fraud, or identity theft.

How Combolists Work

A combolist bundles stolen email addresses or usernames with matching passwords, typically pulled from older breaches, phishing pages, or stealer malware and combined into one large file. Lists of this scale are prized on Telegram and dark web forums because criminals can load them directly into automated tools capable of testing millions of logins across countless websites in a very short time.

Check If You Are Affected

With 9.4 million records in circulation, the odds that your information is included are higher than you might think. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one, and tells you immediately if you have been exposed. Run a free scan now and change any password you may have reused.