What Attackers Can Do With 104 Leaked Office365 SMTP Logins

On 21 February 2026, a combolist titled "Office365_SMTPs" was uploaded to Telegram. HEROIC confirmed the file contains 104 records of email addresses, plaintext passwords, and associated URLs, specifically tied to Office 365 SMTP (email-sending) credentials.

Why This Is Dangerous

SMTP credentials aren't just a way to read email, they let whoever holds them send email as if they were the legitimate account holder. With these 104 sets of Office 365 SMTP logins, an attacker can launch convincing phishing campaigns or spam runs that appear to come from a real, trusted business address.

What Was Exposed

The "Office365_SMTPs" combolist contains:

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Once an attacker has working SMTP credentials, they can send mass phishing emails from a real Office 365 account, which often bypass spam filters more easily than emails from unknown senders. Beyond spam, that same access can lead to account takeover of the underlying mailbox, business email compromise, and downstream fraud against the account holder's contacts.

How This Combolist Was Built

Combolists specializing in SMTP credentials are usually assembled by testing large batches of stolen email and password pairs against Office 365's mail servers, then keeping only the ones that successfully authenticate. Criminals prize these because working SMTP access is directly monetizable for spam and phishing operations, unlike generic logins that may not offer email-sending capability.

Check If You Are Affected

If you or your business uses Office 365, it's worth checking this exposure directly. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, to tell you if your email credentials have been compromised.