205 Records Leaked in Microsoft 16 Uploaded by a Telegram User

In May 2026, HEROIC analysts uncovered a stealer log file shared on Telegram containing 205 records tied to Microsoft account logins. The file included email addresses, plaintext passwords, and the URLs of the login pages those credentials were entered on, information pulled directly from an infected device rather than from a breach of Microsoft's own systems.

Why This Is Dangerous

Unlike a corporate hack, a stealer log comes straight from malware sitting on a victim's computer, quietly copying down every password typed into a browser. Because these 205 passwords are stored in plaintext, no decryption or cracking is needed before an attacker can try them. With the exact login URL included alongside each email and password, whoever has this file can go straight to the real Microsoft sign-in page and attempt to log in as though they were the account owner.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A Microsoft account often unlocks far more than email, it can connect to Office documents, OneDrive files, and other linked services. If any of these 205 users reused their password elsewhere, attackers can attempt credential stuffing against banking, shopping, or social media accounts using the same login. Even at this smaller scale, a stolen Microsoft credential paired with its exact login URL is a direct path to account takeover for anyone whose password was captured.

How Stealer Logs Work

Stealer logs come from information-stealing malware that typically arrives through pirated software, fake browser updates, or malicious attachments. Once running on a device, the malware scans saved browser passwords, autofill fields, and open sessions, then quietly exports that data to whoever controls it. The result is a text file, like the one behind this leak, that gets passed around or sold in Telegram channels and dark web marketplaces. Because it reflects real, recently used credentials, this type of data tends to work more often than passwords pulled from old, previously reported breaches.

Check If You Are Affected

If you use a Microsoft account, especially with a password you have reused elsewhere, it is worth checking whether your details appear in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out your exposure and secure your accounts before someone else uses your credentials.