1,226 Passwords Exposed in Hotmail Fresh B4_Jx Stealer Leak

1,226 records. That is what HEROIC analysts found inside a stealer log dump called "Hotmail Fresh B4_Jx," uploaded to a Telegram channel in late May 2026 by an anonymous user. The data, tied to United States based accounts, included email addresses, plaintext passwords, and the URLs of the sites those credentials were used on.

Why This Is Dangerous

Every one of those 1,226 records is a working login captured directly from an infected device, complete with the exact site it belongs to. Because the passwords are stored in plaintext, there is nothing to crack. Anyone who downloads the file can start using the credentials immediately, with no technical skill required.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login sites

Why This Matters

A dataset of over a thousand records gives attackers enough volume to run automated credential stuffing attempts against email providers, banks, and shopping sites, testing each password against other accounts in case it was reused. Because email addresses are part of this leak, a successful match can let an attacker reset passwords on other services, turning this single leak into a broader case of identity theft or financial fraud.

How Stealer Logs Work

Stealer logs come from infostealer malware, which spreads through pirated software, cracked downloads, or malicious attachments and quietly harvests saved usernames, passwords, and browsing URLs from the victim's browser. Once collected, the resulting file is typically uploaded to Telegram channels or dark web forums, exactly as this one was, giving criminals easy access to over a thousand ready-to-use credential sets.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this stealer log. Run a search today to see if you are among the 1,226 affected records, and change any exposed passwords right away.