Summary: Combolists are collections of stolen credentials pulled from multiple breaches and used for automated attacks. Learn how to neutralize them with proactive dark web monitoring.
A combolist is a core tool in a cybercriminal's arsenal. It's a collection of leaked email and password pairs gathered from multiple data breaches. These simple yet effective datasets are used to fuel automated attacks, such as credential stuffing and account takeovers.
The scale of the problem is staggering. According to our data, in just three quarters of 2025, we identified 13.6 billion email and password pairs, along with 29.7 billion passwords associated with these emails. That's 2.18 passwords for every single email address. It's statistical proof that password reuse is the exact vulnerability that attackers exploit.
But what exactly is a combolist? Where do attackers get them? And how do you stop them from being used to breach your business? Let’s find out.
A combolist (also known as a combo list) is a massive, compiled database of usernames, email addresses, and corresponding passwords, all aggregated from multiple data breaches. Attackers collate this stolen data into a simple text file. The format is simple and effective: [email protected]: password.
The danger of combolists stems from a single human error: password reuse. A password stolen from a low-security gaming forum may be the exact same one used to protect a corporate email account.
Attackers exploit this vulnerability by feeding combolists into automated software for credential stuffing. These tools systematically test leaked login pairs against new targets, waiting for a match.
These lists vary in scope:
While possessing or distributing these lists is illegal, they remain a staple of the cybercrime economy. Their value is determined by freshness. A list with "new" credentials—passwords that have not yet been reset—is considered far more potent and commands a higher price.
The scale of these compiled lists can be massive, showing the extent of exposed credentials:
Our data also confirms that the pool of compromised credentials available to hackers is massive. The volume of newly exposed data is growing rapidly, with the number of emails and passwords collected in Q3 2025 being more than double that of Q1. This trend confirms that the threat related to combo lists continues to increase
Combo lists don't appear from thin air. They are the end product of a long supply chain of cybercrime. While data breaches are a common source, the rapid growth of these lists is now fueled by infostealer malware.
Once a combolist is created, it's shared through various underground channels.
Attackers use combolists for a wide range of attacks, from automated brute-force attacks to highly targeted strikes, such as phishing or identity theft.
This is the most common use for a combolist.
Beyond simply gaining access, combolists enable secondary attacks, such as mass phishing and social engineering attacks. The email addresses are an especially valuable resource for these attacks. Threat actors are aware that these users have already been compromised elsewhere, making them prime targets for additional social engineering attacks.
Combolists are often a key part of the initial access phase for major cyber-attacks. Ransomware groups use them to find a single valid credential for a corporate VPN or Remote Desktop Protocol (RDP) account.
This one "foot in the door" is all they need. From there, they can infiltrate the network and eventually deploy their payload. Some may even use a Ransomware-as-a-Service (RaaS) kit purchased on the dark web.
For example, analyzing how the Akira ransomware group works often reveals that its initial access brokers rely on purchasing compromised credentials—credentials that are frequently sourced from combolists and infostealer logs.
The threat from combolists is not just persistent; it's accelerating. Our research shows the password-to-email ratio in leaked data jumped from 1.39 in 2024 to 2.18 in 2025.
This clearly shows that the core vulnerability—password reuse—remains a growing problem. While the sheer volume of breached data fluctuates, the danger of that data is increasing. For businesses, this means the risk is external, evolving. Here is how you can mitigate these threats:
Mandate that employees use complex and, most importantly, unique passwords for every service. A credential from a combolist is useless if that password was only ever used on one breached, low-value site.
A strong password policy is only practical with a password manager. Encourage or provide a corporate password manager, like NordPass, to help employees generate and store unique passwords for all their accounts.
MFA is the single most effective defense against credential-based attacks. Even if an attacker has a valid username and password from a combolist, they can’t log in without the second factor, for example, a code from an authentication app or a physical key.
Since you can't stop your employees' data from appearing on combolists, the next best thing is to know when it happens. Proactive dark web monitoring scans the dark web for your company's domains, keywords, and credentials.
NordStellar’s threat intelligence platform gives you direct visibility into the combolist threat.
Our continuous dark web monitoring scans the hidden forums, Telegram groups, and illicit marketplaces where combolists are traded. When credentials linked to your employees or customers appear in one of these lists, NordStellar sends an immediate alert.
This allows your security team to take action—such as forcing a password reset—before that leaked login information can be used in a credential stuffing attack, preventing an account takeover or network breach.
See what hackers already know. NordStellar provides continuous monitoring for leaked credentials from combolists and other breaches. Request your free trial today to see your company's exposure.
"ULP" stands for "User, Login, Password." It is essentially another name for a combolist, a file structured with user login details, typically in a user: password format.
An infostealer log is the complete data packet stolen by infostealer malware from a single infected device. It is much more comprehensive than a combolist entry and can include not just passwords but also session cookies, system information, cryptocurrency wallets, and browsing history.
Joanna Krysińska
Senior Copywriter
A writer, tech enthusiast, dog walker, and amateur pastry chef, Joanna grew up in a family of engineers and mathematicians, so a techy mind is in her genes. She loves making complex tech topics less complex and digestible. She also has a keen interest in the mechanics of cybercrime.
