How the USA COMBO List Leaked 3,580 Logins on Telegram

How the "USA COMBO" List Ended Up on Telegram

HEROIC analysts traced how a stealer log named "USA COMBO" made its way onto Telegram on August 18, 2025. The file contains 3,580 records, each one linking an email address to a plaintext password and the URL of the site the login was captured from. The term "combo" is common shorthand in these circles for a combined list of email and password pairs, usually assembled from several stealer infections before being packaged and posted as a single file.

Why This Is Dangerous

Because every password in the file sits in plaintext, an attacker can start using the data the moment they download it, with no cracking step in between. Each of the 3,580 records already lines up a working email, password, and destination site, meaning the file functions as a ready-made attack list rather than raw data that still needs to be processed.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs and endpoints tied to each login

Why This Matters

Combo lists like this one are specifically built for credential stuffing, where attackers feed the entire list into automated tools that test each pair against a wide range of websites at once. If your email and password combination is reused anywhere else, a leak like this can quickly escalate from one exposed account to several, potentially including banking or shopping accounts with financial information attached.

How Stealer Logs Work

The process typically starts when malware infects a device through a pirated download, cracked software, or a malicious attachment, then quietly extracts saved passwords and autofill data from the browser. That stolen information is bundled into a log file and delivered back to the attacker, often automatically through a Telegram bot. From there, an uploader may combine several individual logs into a single combo list like this one before releasing it publicly to attract attention or build credibility.

Check If You Are Affected

Combo lists move quickly once they are posted, so checking your exposure sooner rather than later matters. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including combo lists and stealer logs like this one, so you can confirm whether your credentials are at risk and update any exposed passwords.