The Japan Mix Combolist 18: 13.4M Stolen Credentials Hit the Dark Web

HEROIC analysts identified this stealer log on 04-Jan-2026. The breach exposed 13,495,220 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Combolist 18 Japan Mix Facebook PayPal Azure Office Fresh, uploaded by a Telegram user.

Why This Is Dangerous

With over 13 million credential pairs, this is a massive stealer log that includes logins for high-value services such as Facebook, PayPal, Azure, and Microsoft Office. These are not just generic accounts: they represent access to financial transactions through PayPal, professional cloud environments through Azure, and personal and business communications through Microsoft Office. A single compromised credential from this list can affect multiple services at once.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (website addresses including Facebook, PayPal, Azure, and Office logins)

Why This Matters

The Japan Mix Combolist 18 breach covers accounts used for financial transactions, cloud storage, and business productivity. When PayPal credentials are stolen, funds can be transferred out of linked bank accounts. When Microsoft and Azure logins are compromised, entire business systems can be accessed or shut down. For individual users, this breach opens the door to identity theft, financial fraud, and loss of access to critical accounts.

How a Stealer Log Works

Combolist 18 was assembled from stealer malware that infected devices across Japan and surrounding regions. The malware silently captured login credentials stored in browsers, targeting popular services used in the area. Criminal operators then filtered, verified, and packaged the data by service type before distributing it on dark web forums and private Telegram channels.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.