A combo file is a compiled list of email addresses, usernames, and passwords gathered from multiple breaches, stealer logs, or other leaks. Attackers use it to test credentials across many services. These files are especially dangerous because they often combine old material with newly exposed working passwords.
What a combo file is used for
A combo file is not just a stolen list, it is an attack input. It gives an adversary a ready-made set of username-and-password pairs to test across many sites, which is why it is so useful for credential stuffing, password spraying, and account takeover attempts. The file’s value comes from scale, freshness, and the likelihood that some passwords still work.
Because combo files are assembled from multiple leaks, they often mix very old credentials with newly exposed ones. That combination makes them more dangerous than a single breach dump, since attackers can prioritize the newest or most likely-to-work pairs and automate checks against login forms, APIs, and federated access flows.
How combo files are assembled and why they persist
These lists are typically compiled from breach dumps, infostealer logs, paste sites, and other underground sources. A single source may contain millions of records, but a combo file is usually normalized so attackers can reuse the same format across tooling. The important point is that the file is curated for reuse, not preserved for forensic accuracy.
Combo files also persist because stolen credentials have a long operational half-life. Even if one service resets passwords after an incident, many other services may still accept the same username and password combination, especially where users recycle credentials across personal and business accounts.
For defenders, that persistence matters because exposure is not limited to the original breached service. A password reused on a different platform can turn a distant leak into an active login risk elsewhere.
Why combo files are effective in real attacks
The technique works because many environments still depend on shared secrets as the first line of authentication. Once an attacker has a large enough list, automation can spread attempts over time and across IPs to avoid obvious detection, then focus on valid pairs that unlock access without needing malware, phishing, or zero-day exploitation.
Combo files are especially useful when paired with MITRE ATT&CK Enterprise Matrix concepts such as credential access, lateral movement, and account abuse. They are also directly relevant to NIST SP 800-63 Digital Identity Guidelines, because stronger authentication and phishing-resistant methods reduce the value of stolen passwords.
When a valid pair succeeds, the attacker often gains more than one login. Saved sessions, password resets, app-specific tokens, and linked recovery paths can all become follow-on access mechanisms that extend the impact well beyond the original credential check.
Defensive response and monitoring priorities
Defending against combo files starts with understanding where reused credentials could still work and where the login surface is exposed to the internet. Teams should watch for repeated failed logins, impossible-travel anomalies, unusual user-agent patterns, and success after a burst of prior failures, especially on high-value accounts and externally reachable identity providers.
The right control mix is usually layered: rate limiting, bot detection, MFA, passwordless or phishing-resistant authentication, breached-password screening, and rapid revocation when compromise is suspected. OWASP API Security Top 10 is useful here because many modern attacks target API login endpoints as aggressively as human-facing portals.
Post-incident review should also look for downstream abuse, not just the successful login. Attackers often use one working credential to enumerate account settings, create persistence, alter recovery options, or pivot into email, VPN, SSO, cloud consoles, and SaaS admin panels.
Risk and Threat Considerations
Combo files are dangerous because they turn previously stolen data into scalable account takeover infrastructure. Their biggest risk is not the leak itself, but the fact that one working pair can unlock many unrelated services when password reuse, weak rate controls, or exposed login endpoints are present.
Failure mechanism: Attackers automate login attempts against large credential sets, filter for successful pairs, and then use those accounts for fraud, data theft, persistence, or further compromise.
Impact: A single successful match can lead to mailbox access, cloud privilege abuse, session hijack, payment fraud, or broader intrusion across connected systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1110 — Brute Force | Combo files are used to automate credential abuse at scale. |
| Recommendation — Detect and block large-scale login attempts that reuse stolen username-password pairs. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Shows why stronger identity proofing and authenticators reduce password replay value. |
| Recommendation — Adopt phishing-resistant authenticators and step-up checks for risky logins. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Combo files exploit weak password lifecycle and reuse across services. |
| Recommendation — Enforce secure authenticator lifecycle controls and revoke compromised credentials quickly. | ||
| CIS Controls v8 | 5 — Account Management | Credential stuffing attacks depend on poorly governed accounts and login exposure. |
| Recommendation — Harden account controls, monitor login abuse, and remove stale access paths. | ||
Practitioner Guidance
Why practitioners should care: Combo files are a practical signal that authentication controls must be judged by real abuse resistance, not only by password policy on paper. If users can reuse passwords and the login path is easy to automate, the organisation is already in the attacker’s workflow.
What to watch for: Look for sudden spikes in failed logins across many accounts, logins from unusual geographies or device fingerprints, and repeated attempts against the same identity from distributed sources. Those patterns often show that a combo file campaign is underway.
Practitioner takeaway: Treat leaked credential reuse as an exposure problem, not just a password problem, and verify that detection, step-up authentication, and recovery controls are aligned to that reality.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org