One SQIL Mix Password Could Unlock a Chain of 648,421 Accounts

HEROIC's threat intelligence team detected the twelfth installment of a large multi-part breach series labeled MIX NEW SQIL PART 12 circulating on Telegram. Appearing in February 2023, this volume alone contains 648,421 records with email addresses, plaintext passwords, and URLs. The "SQIL" designation suggests the data originates from SQL injection attacks combined with stealer log aggregation, creating a particularly diverse and dangerous credential collection.

Plaintext Passwords from SQL Dumps Are Immediately Weaponizable

All 648,421 passwords in this collection are stored in plaintext. Whether extracted through SQL injection exploits against vulnerable databases or harvested by infostealer malware, the end result is the same: completely unprotected credentials that attackers can use instantly. At this scale—the twelfth part of an ongoing series—the cumulative volume of exposed credentials across all parts reaches into the millions, representing an enormous attack surface.

What Was Exposed

• Email Addresses — login identifiers harvested from compromised databases and infected devices worldwide
• Plaintext Passwords — unencrypted credentials from both database dumps and browser storage
• URLs — a broad mix of web services, forums, e-commerce sites, and platforms where credentials were used

Multi-Source Data Makes Credential Stuffing Devastatingly Effective

The MIX NEW SQIL series blends credentials from multiple breach sources—SQL injection exploits, stealer logs, and aggregated combolists—into one massive collection. This diversity means attackers get credential pairs from a wider range of services and time periods, increasing the likelihood that some passwords are still active. With 648,421 pairs in this single volume, automated credential stuffing tools can test each combination against hundreds of target services, exploiting every instance of password reuse they encounter.

SQL Injection Meets Stealer Malware: A Double Threat

The SQIL series represents a convergence of two distinct attack methods. SQL injection attacks target vulnerable web applications to extract entire user databases directly from servers, while infostealer malware harvests credentials from individual endpoints. When combined, these sources produce comprehensive credential collections that cover both server-side database leaks and client-side browser captures. This dual approach maximizes the breadth and freshness of the exposed data, making it particularly valuable to cybercriminals.

Check If Your Credentials Were Exposed

HEROIC maintains a breach intelligence database with over 400 billion records from data breaches, stealer logs, and dark web monitoring. Use HEROIC's free breach scanner to check if your email or passwords appear in the MIX NEW SQIL PART 12 dump or any other known compromise. If a match is found, change the affected passwords immediately across all services, use a password manager to generate unique credentials for every account, and enable two-factor authentication wherever it is supported.