One File Named RDHQ Combos 4: 5,518 Mail Logins Leaked Online

One File Named RDHQ_MailAccess_Combos_4: 5,518 Mail Logins Leaked

HEROIC analysts identified a file labeled RDHQ_MailAccess_Combos_4, uploaded to a Telegram channel on 5 June 2026. The file contained 5,518 records, each pairing an email address with a plaintext password and the URL of the mail or login page the credential was used on. The naming convention points to a criminal group organizing its stealer log output into numbered batches focused specifically on mail account access.

Why This Is Dangerous

Because this data was pulled directly from infected devices rather than an old hacked database, the 5,518 email and password pairs in this file are more likely to be current and functional. An attacker does not need to crack anything. The email, the plaintext password, and the exact mail login page it belongs to are already paired together, ready to use.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the mail and login pages tied to each credential

Why This Matters

Mail access is a high-value target because an inbox often holds the keys to resetting passwords on banking, shopping, and social media accounts. If any of the 5,518 people in this file reused their email password elsewhere, an attacker can use credential stuffing to break into those accounts as well. Once inside an inbox, an attacker can read private messages, intercept password reset emails, and set the stage for identity theft or financial fraud.

How Stealer Logs and Combo Files Work

A stealer log is produced by information-stealing malware that infects a device through a pirated download, a fake update, or a malicious attachment, then quietly harvests saved passwords, autofill entries, and open sessions from the browser. Criminal groups often organize their output into labeled combo files, like this RDHQ_MailAccess_Combos_4 batch, specifically curated for mail account access rather than mixed data. These files are then shared or sold on Telegram channels and dark web forums, where other criminals look specifically for accounts they can exploit.

Check If You Are Affected

With 5,518 mail accounts exposed in this file alone, it is worth checking whether your email address is among them. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs and combo files like this one, and tells you right away if you have been exposed. Run a free scan today to check your status.