A combolist is a file of username and password pairs, usually email addresses and passwords, compiled from many past breaches and used to try logins on other services. A stealer log is the data copied from one infected device. A credential dump is the raw data from a single breach. This post explains how they differ and what defenders do. It does not say where to find any of them.
What is a combolist?
Security researcher Troy Hunt describes “combos” as a combination of usernames, usually email addresses, and passwords, compiled into lists that can be used for credential stuffing. He defines that as the automated injection of breached username and password pairs to gain access to user accounts. MITRE describes the same idea: adversaries may use credentials from breach dumps of unrelated accounts to gain access to target accounts, taking advantage of the tendency to reuse passwords across personal and business accounts.
The people on a combolist did not do anything wrong on the target service. As Hunt puts it, “it’s not personal, you’re just on the list”. Our post on account takeover and credential stuffing separates the method from the outcome.
What is the difference between a credential dump, a combolist and a stealer log?
| What differs | Credential dump | Combolist | Stealer log |
|---|---|---|---|
| Where it comes from | One breached service | Many breaches merged into one file | One infected device |
| What it holds | The data taken from that service | Username and password pairs | Credentials, browser data, wallets and MFA details, per CISA on one stealer |
| How it is used | Cracked or checked against that service | Tried on other services in bulk | Every login saved on that device is at risk |
| Main defense | Reset that service’s passwords | Unique passwords and MFA | Treat the device as infected |
A leaked credential is the umbrella term for any of the three. The stealer logs glossary entry covers the third in more detail, and the infostealer entry covers the malware that produces them.
How do passwords end up in credential dumps?
A service is breached and its user table is copied. Passwords are usually stored as hashes, but Hunt notes that the collection contained “dehashed” passwords, which had been cracked and converted back to plain text. Dumps are then merged. The 2019 collection Hunt analyzed held 2,692,818,238 rows built from many different breaches, with 1,160,253,228 unique email and password pairs. He says the breaches varied in age, with one dating from 2015 and a file suggesting 2008, and that he could not verify every source, so claims about such collections stay claims until checked.
- 2.69 billionRows in the collectionSource: Troy Hunt, Collection #1 analysis, 2019
- 1.16 billionUnique email and password pairsSource: Troy Hunt, Collection #1 analysis, 2019
- 21.2 millionUnique passwordsSource: Troy Hunt, Collection #1 analysis, 2019
These numbers show why a combolist works as a bulk tool: even if only a small share of people reuse a password, the list is large enough to produce hits.
How do stealer logs reach criminals?
Stealer logs come from malware on a device, not from a breached service. The FBI and CISA say one stealer can exfiltrate personally identifiable information, financial credentials, cryptocurrency wallets, browser extensions and multifactor authentication details. They also cite private sector statistics of more than 21,000 market listings selling logs from that stealer on multiple cybercriminal forums from April through June 2024, a 71.7 percent increase from the same period in 2023. Logs are sold on forums and in the same underground trade that sells stolen cards: see carding forums and sites. For how messaging channels fit in, see Telegram leaks and dark channels.
How can you defend against combolists and stealer logs?
Against combolists the aim is to make a reused password useless. Against stealer logs the aim is to remove the infection and the sessions it copied. NIST says verifiers must compare a new password against a blocklist of known commonly used, expected or compromised passwords, and that the blocklist may include passwords from previous breach corpuses. MITRE lists multi-factor authentication and proactive resets of accounts known to be in breached credentials as mitigations, and describes detecting bursts of failed logins that use leaked credential pairs.
- Block breached passwordsCheck new passwords against a list of known compromised ones, as NIST requires.
- Turn on MFAPrefer phishing-resistant MFA on every external login.
- Reset exposed accountsReset any account that appears in breached credentials, before an attack starts.
- Watch for login burstsAlert on many failed logins with different username and password pairs from one source.
- Treat a stealer hit as an infectionIsolate the device, end sessions and reset every saved login from a clean device.
Our playbooks give the full response for leaked credentials and infostealer log exposure. The use cases leaked credential monitoring and data leak detection show how teams watch for their own data, and hacker and leak forums 101 and the BreachForums timeline explain where such data is traded. For the full takeover path, read how attackers use stolen credentials.
Sources
Troy Hunt analyzed the Collection #1 data and explained combos and credential stuffing (Have I Been Pwned author, 2019). MITRE ATT&CK describes credential stuffing, mitigations and detection (T1110.004). The FBI and CISA describe what one stealer takes and the number of log listings (advisory AA25-141B). NIST sets the blocklist requirement (SP 800-63B-4).
Last checked against sources: 10 October 2026.