The Zoho SMTP Leak Contains Exactly 1,670 Working Email Credentials

In April 2026, HEROIC analysts found a combolist labeled "Zoho_SMTPs" circulating on a Telegram channel. Dated April 18, 2026, the file contains 1,670 records made up of email addresses, plaintext passwords, and URLs, all tied to Zoho email accounts configured for SMTP, the protocol used to send outgoing mail. Why Leaked SMTP Credentials Are Dangerous SMTP credentials do more than unlock an inbox, they let whoever holds them send email through that account's mail server. Anyone using these 1,670 Zoho logins could send messages that appear to come from real people and real domains, which is exactly what spammers and phishing operators look for when they want their messages to slip past spam filters. What Was Exposed in the Zoho_SMTPs Combolist Zoho email addresses Plaintext passwords Associated SMTP URLs Why This Matters Beyond the obvious risk of someone reading your email, stolen SMTP credentials fuel credential stuffing against other accounts that share the same password, and they let attackers send convincing phishing emails from a real, working account. For the people behind these 1,670 records, that can mean anything from a hijacked inbox to fraudulent messages sent to contacts, coworkers, or customers in their name. How SMTP Credential Combolists Get Built Lists like this one are usually pulled together from stealer malware logs, phishing pages disguised as email provider login screens, or leaked configuration files that store mail server settings in plaintext. Once collected, the working email and password pairs are compiled into a single combolist and passed around Telegram channels, where spammers and scammers buy or trade them for access to mail servers they can use to send their own messages. Check If You Are Affected If you use a Zoho email account or have ever reused a password across your email and other services, it's worth checking whether your details appear in this leak. HEROIC's free breach scanner checks against more than 400 billion exposed records, so you can find out quickly and update any passwords that may be compromised.