Every day massive amounts of stolen credentials circulate quietly across the internet. Most users never see them, but attackers actively rely on these datasets to break into corporate systems at scale.
These collections of exposed usernames and passwords are known as Combo Lists and they play a key role in many of today’s most common cyberattacks.
Understanding what Combo Lists are, where they come from and why they matter is essential for any organization looking to stay ahead of credential-based threats.
In this article, we’ll break down how Combo Lists are created, how attackers use them and how they can be leveraged defensively to improve enterprise security.
Key Takeaways
- A Combo List is a ready-to-use file of username/email + password pairs, aggregated from breaches, leaks and infostealer malware.
- They exist to be fed into automated tools. Attackers don't test credentials by hand, they run them against hundreds of login portals at once.
- Password reuse is what turns an unrelated third-party breach into a corporate VPN compromise.
- Combo lists are the single largest category of exposed credentials in SynScan's database, ahead of every individual breach.
- The same data is usable defensively: monitoring it tells you which of your accounts are exposed before attackers get to them.
What are they?
Combo Lists or credential combo lists, are collections of user/email + password pairs obtained from security breaches, data leaks, infostealer-type malware or through credential reuse across multiple services.
These lists are usually found in private Telegram channels, underground forums and hidden corners of the dark web. They represent one of the primary sources for automated attacks.
They are typically shared as plain text files (or compressed archives containing them), with one credential pair per line separated by a colon or similar delimiter. A single file can contain anywhere from a few thousand to hundreds of millions of records, often aggregated and repackaged from multiple older breaches.
| Combo List Types | Description |
|---|---|
| Classic Combo Lists | Contains only user/email and password pairs. |
| Combo Log Lists | Includes additional data extracted by malware, such as URLs, user/email, passwords, cookies, tokens and other session-related information. |
Anatomy of a Combo List
Combo lists are deliberately boring. There is no encryption, no database engine and no structure beyond one credential per line. That simplicity is the point: the file has to be readable by any tool, instantly, at any scale.
A classic combo list uses a single delimiter, almost always a colon, separating the identifier from the password:
[email protected]:Summer2024!
[email protected]:Liverpool1892
[email protected]:Qwerty123456A combo log list (extracted from infostealer output) adds the URL the credential was saved for, which is what makes it far more dangerous. The attacker no longer has to guess where a password works, the file tells them:
https://vpn.company.com/login:[email protected]:Tr0ub4dor&3
https://mail.company.com:[email protected]:Tr0ub4dor&3
https://github.com/login:[email protected]:Tr0ub4dor&3Read those three lines the way an attacker does. The same password protects a corporate VPN, a corporate mailbox and a personal GitHub account. One infection, one reused password, and the whole set falls at once. This is why the URL field turns a nuisance into an incident, and why we parse and normalize it rather than treating every list as a flat dump.
Why are Combo Lists important for enterprise cybersecurity?
Combo Lists pose a significant risk for organizations, mainly due to password reuse by employees. A single compromised credential pair can enable:
- Credential stuffing attacks against corporate services.
- Unauthorized access to VPNs, email accounts, CRMs, or internal panels.
- Privilege escalation and lateral movement within the organization.
- Theft of sensitive or confidential client data.
Attackers rarely test these credentials by hand. Combo Lists are designed to be fed into automated credential stuffing tools, which try thousands of user/password combinations per minute against login portals. Because many people reuse the same password across services, a password leaked from an unrelated website can end up unlocking a corporate VPN or email account.
From a defensive perspective, monitoring and analyzing Combo Lists allows cybersecurity teams to stay ahead of incidents, identify exposed credentials and enforce security measures such as password resets, MFA or preventive account restrictions.
How attackers actually use a Combo List
A combo list on its own is inert. What makes it dangerous is the mature, cheap tooling built around it. The workflow below is essentially industrialized, and it is the reason a leak from an unrelated forum ends up costing your organization an incident response.
Acquire the list. Lists are downloaded free from Telegram channels to build reputation, or bought cheaply. Cost is rarely a barrier, which is why the volume in circulation keeps growing.
Load it into a checker. Tools such as OpenBullet or SilverBullet take the list plus a config: a small script describing how a specific site's login works. Configs for popular services are traded like any other commodity.
Rotate through proxies. Requests are spread across thousands of residential IPs so the traffic looks like normal users in normal places. This is what defeats naive IP-based rate limiting, and why login attempts may never look anomalous from any single address.
Validate and capture hits. Successful logins ("hits") are saved automatically, often along with account details such as plan, balance or role, so the attacker instantly knows which accounts are worth the most.
Exploit or resell. Valid corporate accounts are used directly, or sold to initial access brokers who resell them to ransomware operators. The credential's journey typically ends as somebody else's breach.
The economics are brutally asymmetric: the attacker needs one password to still work. You need every password to have already been changed.
Combo lists in SynScan's data
29.8 B+
Credentials indexed from combo lists
23
Combo-list collections tracked
3,512
Breached databases indexed
SynScan platform data, refreshed daily.
This is not a theoretical category. When we group everything we've indexed by the type of source it came from, combo lists are the single largest bucket of exposed credentials we hold, ahead of every individual company breach, and ahead of the stealer logs they're often built from.
Credentials indexed by SynScan, by source category. Top 8 of 47 categories.
The shape of this chart is the argument for monitoring them. A single breached company exposes its own users. A combo list aggregates across thousands of breaches at once and re-circulates them for years, which is how a password your employee set in 2019 on an unrelated site is still being tried against your VPN today.
Those billions are not an abstraction either. They are specific, named files that have been circulating for years, and we index each of them individually:
The largest combo-list datasets indexed by SynScan.
Some of these names will be familiar: Collection #1, ANTIPUBLIC #1 and Exploit.in are years old, and they are still being fed into checkers today, because a password only has to work once. You can browse every combo-list dataset we index and see exactly what each one contains.
How we approach this at SynScan
At SynScan, we identified Combo Lists as a highly valuable asset for protecting our clients, which led us to integrate them into our threat intelligence scope. This is our process:
Automated source monitoring. Our tooling continuously monitors the sources where threat actors share this data, such as Telegram channels and underground forums. New posts are collected and processed automatically, allowing us to detect fresh credential exposures shortly after they are published.
File download. Once a relevant post is identified, the shared files are retrieved, whether they are direct attachments or links to external file hosting services.
Analysis and classification. Compressed archives are extracted and every file is inspected. Content-based heuristics verify that the data follows a valid credential format and distinguish Combo Lists from infostealer logs, discarding junk and duplicated files along the way.
Parsing and normalization. Since every list comes in a different format, dedicated parsers transform the raw data into structured, normalized records: email, username, password and the source where it was found.
Indexing and alerting. The normalized records are indexed into our search infrastructure, which holds billions of exposed credentials. From there, exposures matching our clients' domains are surfaced in the platform, so security teams can act before attackers do.
The result is a continuously updated credential exposure dataset that turns the same data attackers rely on into an early warning system for our clients.
Combo lists vs stealer logs
The two terms get used interchangeably, but they are different things, and the difference decides how you respond. A combo list exposure means a password is public. A stealer log exposure means a machine is compromised.
| Combo List | Stealer Log | |
|---|---|---|
| Contents | Username/email + password pairs, sometimes a URL. | Everything on the device: credentials, cookies, autofill, system info, screenshot. |
| Origin | Aggregated from many breaches, leaks and older lists. | Output of a single malware infection on a single machine. |
| Bypasses MFA? | No. A password alone is stopped by MFA. | Often yes, via stolen session cookies. |
| Your response | Reset the password everywhere it was reused. | Treat the device as compromised: clean it, reset everything, revoke sessions. |
Combo lists are frequently built from stealer logs, which is why the two categories sit side by side at the top of our data. If you want the full picture of the second one, read our companion article on infostealers and stealer logs.
How to protect your organization
You can't prevent third-party services from being breached, but you can limit the impact a leaked credential has on your organization:
- Enforce multi-factor authentication (MFA) on all corporate services, especially VPNs, email and admin panels. A leaked password alone should never be enough.
- Prohibit password reuse between corporate and personal accounts, and encourage the use of password managers.
- Monitor credential exposures for your domains, so compromised accounts are detected and reset before they are exploited.
- Apply rate limiting and bot detection on login endpoints to blunt credential stuffing attempts.
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A data breach is the incident where information is stolen from a specific service. A Combo List is a derived product: attackers extract the user/password pairs from one or more breaches (or from infostealer malware), aggregate them and repackage them into a format ready for automated attacks.
The most common paths are a breach of a service where you had an account, or an infostealer infection on a device where you saved or typed your passwords. Once stolen, credentials are traded and re-shared, so the same pair can keep resurfacing in new lists for years after the original incident.
You need visibility into the sources where these lists circulate, which is impractical to do manually. Services like SynScan continuously collect and index Combo Lists, letting you monitor your domains and get alerted when credentials belonging to your employees or customers show up in newly published data.
Reset the affected passwords immediately, including on any other service where the same password may have been reused, and revoke active sessions. If the exposure comes from an infostealer log, also check the affected device for malware, since cookies and session tokens may be compromised too. Finally, review authentication logs for suspicious access and make sure MFA is enforced.
Overwhelmingly plaintext. That is the whole point of the format: a checker has to be able to submit the password directly. Hashes taken from a breach are usually cracked first and only then packaged into a list, which is why weak or common passwords resurface fastest. Credentials taken from infostealer logs are plaintext from the start, since the malware reads them straight out of the browser.
Our own data says the same thing: 18 of the 23 combo-list datasets we index store their passwords in plaintext. Only a handful contain hashes at all, and those are typically the ones that were repackaged straight from a breach without being cracked first.
Continuously. New lists appear daily across Telegram channels and forums, though most are repackaged versions of data that is already circulating, which is why deduplication matters as much as collection. The practical consequence is that a credential exposure is not a one-off event to check once: the same pair can reappear in new lists for years, so monitoring has to be ongoing rather than a point-in-time audit.