Inside WorkingSMTPs: How 123 Leaked Logins Enable Spam Attacks

HEROIC analysts found a combolist called WorkingSMTPs, uploaded to a Telegram channel on November 25, 2025. Unlike a typical list of website logins, this file contains 123 records pairing email addresses with plaintext passwords and URLs specifically confirmed to work for SMTP, the protocol email servers use to send outgoing mail.

Why This Is Dangerous

SMTP credentials let anyone send email as if they were the legitimate account owner. Because these logins are labeled "working," whoever obtains this list can immediately start sending mail through real accounts rather than needing to set up their own infrastructure, which also makes their messages far more likely to land in inboxes instead of spam folders.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

When an attacker can send email through a real, working account, they can launch convincing phishing campaigns, spread malware, or run spam operations that are harder to block because the messages come from a legitimate source. If your account is one of the 123 exposed here, criminals could impersonate you to your own contacts, damaging your reputation and putting people who trust you at risk.

How Combolists Work

A combolist bundles email or username and password pairs, often pulled from stealer logs or older breaches, into a single file ready for immediate use. What makes WorkingSMTPs notable is its focus: rather than a random mix of website logins, it specifically targets credentials that have been tested and confirmed to work for sending mail, making it valuable to spammers and phishing operators looking for ready-to-use sending accounts.

Check If You Are Affected

Even with only 123 records exposed, if your email account is on this list, someone else may already be able to send mail as you. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like WorkingSMTPs, so you can find out right away and change your password before it is misused.