Naz.API (2023): 71 Million Credentials From Infostealer Logs and Combo Lists

About Naz.API

Naz.API is not a breached company but a large aggregated credential collection assembled from infostealer-malware logs and prior credential-stuffing lists, and widely used to seed account-takeover tooling.

Why They Hold Your Data

As an aggregated dataset, it combines email addresses, passwords and some phone numbers captured by infostealer malware on victims' devices and pulled from earlier combo lists.

Recent Developments

Naz.API was posted to a hacking forum in September 2023 by a user identified as '0x64'; HIBP indexed about 71 million unique email addresses from it in early 2024.

Data Points Exposed

Breach Impact

As an infostealer-sourced aggregation, it signals device-level compromise for many victims and fuels credential-stuffing and account-takeover at scale.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses

What You Should Do

1. Reset any reused passwords and enable MFA on email first, then financial accounts.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).