The Microsoft 18 Combolist: 7,945 Email and Password Pairs Leaked

In May 2026, HEROIC analysts tracked a combolist labeled "microsoft 18" after it was uploaded by a Telegram user. The file contains 7,945 records of email addresses and plaintext passwords, along with the URLs where each credential pair was used. Why This Is Dangerous: a file named after Microsoft suggests the credentials inside are tied to Microsoft account logins, webmail, Office 365, or related services many people use for both work and personal email. Because the passwords are plaintext, anyone who gets the file can use the credentials immediately without any technical effort. What Was Exposed: email addresses, plaintext passwords, and URLs tied to each login. Why This Matters for Microsoft Account Holders: a Microsoft account often unlocks email, cloud storage, and even work systems for people who use Microsoft 365 for their job. If one of these 7,945 credential pairs matches a real, active account, an attacker could read someone's inbox, reset other passwords through email recovery, or use stored files and contacts for further fraud and identity theft. How Combolists Like This Get Labeled and Sold: uploaders often name combolists after the service the credentials are believed to unlock, in this case Microsoft, to make the file easier to market to buyers looking for a specific target. The number 18 likely marks this as one entry in a numbered series the same uploader has been releasing. These files are typically built from a mix of older breaches, phishing kits, and stealer malware output. Check If You Are Affected: if you use a Microsoft account for email or work, it's worth checking whether your credentials appear in leaks like this one. HEROIC's free breach scanner searches a database of more than 400 billion exposed records so you can see your exposure in seconds and secure your account before it's misused.