2,755 Hotmail Accounts Exposed in Telegram Stealer Log Leak

On 13 May 2026, a Telegram user uploaded a stealer log file called "HOTMAIL TEST 2" containing 2,755 stolen login records. The file pairs email addresses with plaintext passwords and the URLs those passwords were captured from, the same pattern seen across other stealer logs, credentials lifted from infected devices rather than a breach of Microsoft's own systems.

Why a "Test" File Held Thousands of Real Logins

The name "HOTMAIL TEST 2" suggests this file was a trial run, likely used to check a scraping tool or a new batch of malware output before a larger release. Despite the casual label, it still contained 2,755 working email and password pairs, real accounts belonging to real people, showing that even "test" uploads on Telegram can carry serious volumes of usable credentials.

What Was Exposed in the 2,755-Record File

• Email addresses
• Plaintext passwords
• URLs showing exactly which login page each password unlocks

Why 2,755 Exposed Logins Adds Up to Real Damage

With plaintext passwords already matched to specific login pages, attackers can skip straight past guessing or cracking and log in directly. At this scale, the file becomes a ready list for credential stuffing across banking, retail, and social media accounts. Anyone reusing a password from this list elsewhere is exposed to account takeover, identity theft, and financial fraud that can reach well past a single Hotmail inbox.

How "Test" Uploads Like This Get Made

Before releasing a full stealer log to buyers, operators often upload a smaller "test" version, like this one labeled "TEST 2", to demonstrate the malware or scraping setup is working and to gauge interest from other criminals on Telegram. The credentials themselves come from infostealer malware quietly copying saved browser logins off infected devices, so a "test" label doesn't make the exposed data any less real.

Check If Your Email Is Among the 2,755 Exposed

If you have a Hotmail or Outlook account, or reuse passwords across email providers, it's worth checking whether your details appear in this leak. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, and gives you an instant answer.