The scorp_Office365_SMTPs Leak Could Let Attackers Hijack Your Inbox

On August 2, 2026, HEROIC analysts found a combolist called scorp_Office365_SMTPs, uploaded to a Telegram channel by an anonymous user. The file contains 144 records pairing email addresses with plaintext passwords and the URLs of the Office 365 accounts they access.

What Attackers Can Do With the scorp_Office365_SMTPs Leak

SMTP access tied to an Office 365 account gives an attacker the ability to send email as if it were coming directly from that account, not just read what's already there. With 144 working email and password pairs in plaintext, someone could log into these business inboxes, send convincing phishing emails to coworkers and clients, or intercept and redirect sensitive communications.

What Was Exposed in the scorp_Office365_SMTPs Leak

• Email addresses
• Plaintext passwords
• URLs linking each account to its login page

Why This Matters

Business email accounts are a common entry point for larger fraud schemes, including invoice scams and business email compromise. Even a small leak of 144 accounts is enough to give an attacker a foothold inside an organization's email system, which can escalate into financial fraud, identity theft, or further account takeover across other connected services.

How Combolists Work

A combolist pairs email addresses or usernames with passwords, typically gathered from older breaches, malware logs, and prior leaks, then compiled into a single file. Criminals test these credentials against email and login systems using automated tools, and because business accounts are frequently reused across personal and work logins, even a small combolist like this one can open the door to account takeover.

Check If You Are Affected

If your organization uses Office 365, it's worth checking whether any of your accounts appear in the scorp_Office365_SMTPs leak or another breach. HEROIC's free breach scanner searches a database of more than 400 billion leaked records in seconds, so you can catch exposed credentials before they're used against you.