Researchers Link Mix Fresh B4_Jx Combolist to 101 Stolen Logins

HEROIC analysts link a combolist named Mix Fresh B4_Jx to 101 stolen credential records uploaded by a Telegram user on 18 April 2026. The file follows a familiar combolist format: email addresses paired with plaintext passwords and the URLs of the login pages they belong to.

Why This Is Dangerous

Calling a list "fresh" is a seller's way of signaling the credentials are recently harvested and largely untested, meaning they are more likely to still work than an old, widely circulated dump. Even at just 101 records, every entry represents a real account with a working password sitting in plaintext, ready for anyone who downloads the file to try.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

Because the passwords are in plaintext and matched to their exact login page, an attacker can attempt access immediately, no cracking required. If any of these 101 users reused their password on other accounts, the exposure extends to email, banking, or social media logins well beyond this one file, a common trigger for credential stuffing attacks.

How Combolists Work

A combolist is built by collecting email and password pairs, often from stealer logs or recent phishing campaigns, then formatting them into simple lines that pair each login with the site it opens. Small, "fresh" batches like this one are frequently shared on Telegram as samples or teasers before a larger, paid version is sold to more serious buyers.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including small combolists like this one that never make the news. Run a free search to see if your address is among the 101 exposed.