What Is a Combolist?

An employee’s work email appears in a newly circulated credential list. Does that mean your company has been breached? Was the employee’s laptop infected? Can someone sign in to the account today?

A combolist alone cannot answer those questions. It does, however, give your security team a reason to check. Understanding what the list contains—and what it leaves out—helps you respond to a possible exposure without drawing the wrong conclusion.

What is a combolist?

A combolist is a bulk collection of login identifiers and passwords, typically arranged as one pair per line. A record might resemble name@example.com:password. Some lists also include a website address or other fields, but many contain only the identifier and password.

These lists are usually compiled from data already exposed elsewhere. Sources can include breached databases, credentials extracted by infostealer malware, and older combolists repackaged into new collections. Their compact, consistent format makes the records easy to sort and process at scale.

A pair’s presence does not establish that it is current or valid. It may be old, duplicated, incorrectly matched, or already changed. Nor does it establish that the organization named in the email address suffered a breach: the password may have been exposed through an unrelated service or a compromised personal device.

How do combolists lead to account attacks?

The principal risk is credential stuffing. Attackers test exposed username-and-password pairs against other services, hoping that someone has reused the same password. If a work email and password used on a personal site also work for a business account, a breach outside the business can become an access problem inside it.

This differs from password guessing. The attacker starts with a pair that has appeared in exposed data and checks whether it works elsewhere. Individual login attempts may look ordinary, while the pattern across many accounts reveals automated abuse. A single per-account lockout rule may therefore miss a campaign that spreads attempts across numerous users. OWASP recommends layered protections, including multifactor authentication, breached-password checks, rate limits, and monitoring for suspicious login patterns.

Combolist or stealer log: why the source matters

A stealer log is the output of an infostealer infection on a device. Depending on the malware and the data available, it may contain saved credentials, website addresses, session cookies, and information about the affected computer. A combolist can be assembled from the credential pairs extracted from many such logs, with much of that context removed. It can also contain records from entirely different sources.

That distinction changes the response. A combolist finding tells you a credential may have been exposed; it does not, on its own, tell you where it came from or whether a particular device is infected. If the underlying stealer log is available and links the record to a device, the investigation can extend to that device and to other accounts or sessions exposed by the same infection. Learn more about stealer log monitoring and infostealer malware.

Even a record containing a website address is not necessarily a complete incident history. The original capture date, device, and any stolen session material may still be unknown. Treat source attribution as evidence to verify, not an assumption to make from the file format.

What should a business do when credentials appear?

First, identify the account and assess the evidence: which identifier appeared, whether the associated service is known, when the data was observed, and whether the source is a breach collection or a stealer log. An email-domain match alone does not establish that the organization’s own systems were breached.

Then check whether the exposed password could still be in use. Reset the affected account’s password where appropriate, and replace that password on every other account where it was reused. Review recent sign-ins and relevant alerts for signs of unauthorized access. If there is evidence of a compromised device or stolen session cookies, investigate the device and invalidate affected sessions as well; a password reset alone may not end an already authenticated session.

The longer-term controls matter just as much:

• Require unique passwords for each account, ideally generated and stored with a password manager.
• Enable multifactor authentication, with phishing-resistant methods where available. MFA greatly reduces the risk from a stolen password, though it does not resolve a stolen active session.
• Check newly chosen passwords against lists of common or compromised passwords, as recommended by NIST.
• Monitor authentication activity across accounts and sources, rather than relying only on per-account lockouts.
• Monitor relevant credential exposure so your team can investigate new findings and prioritize those with reliable source context.

Why a record count is not the whole story

A large number in a headline does not necessarily mean a new breach or that every entry represents a distinct, usable account. Combolists can mix newly exposed data with older, duplicated, or invalid records. For a business, the useful questions are more specific: Does the data relate to our users or services? Is the credential still in use? Do we know its source? Is there evidence of device compromise or suspicious sign-ins?

A combolist is an exposure signal, not a complete diagnosis. The more context you can establish, the more precisely you can decide which accounts, sessions, and devices require action.

Check credential exposure with context

SphereTI monitors exposed credentials and stealer logs linked to an organization’s domain. That context helps teams distinguish a credential appearing in a bulk list from a finding tied to an infected device and decide what to investigate next. Learn how stealer log monitoring works.