2,845 Hotmail Passwords Were Just Dumped on Telegram

HEROIC identified a stealer log dump labeled "CHEETAH Hotmail Hits" that was shared on a Telegram channel in March 2025. The file contains 2,845 validated Hotmail account credentials, each paired with plaintext passwords and the URLs where those credentials were entered, handing attackers a direct path into victims' inboxes.

The Immediate Danger of Exposed Plaintext Passwords

Plaintext passwords require zero effort to exploit. There is no hash to crack, no encryption to break. An attacker who downloads this file can begin logging into Hotmail accounts within seconds. Because Hotmail accounts are often linked to Microsoft services, OneDrive, and other platforms, a compromised Hotmail password can unlock far more than just an inbox.

What Was Exposed

• Email Addresses — Hotmail accounts targeted specifically
• Plaintext Passwords — immediately usable without any decryption
• URLs — showing which login pages the credentials were harvested from

Why Credential Stuffing Makes This Worse

Attackers do not stop at one service. They feed stolen email-and-password combinations into automated tools that test them against banking portals, shopping sites, streaming platforms, and social media networks. If you used the same Hotmail password anywhere else, every one of those accounts is now vulnerable. Credential stuffing succeeds at alarming rates because password reuse remains widespread.

Understanding Stealer Log Malware

This data was harvested by infostealer malware running silently on infected devices. These programs monitor keystrokes, extract saved browser passwords, steal session cookies, and capture autofill data. The stolen credentials are compiled into structured log files and distributed through Telegram groups, where they are traded or given away to other threat actors.

Check If Your Credentials Were Exposed

If you use Hotmail or have ever used a Hotmail-linked password on other services, you should verify whether your credentials appear in this dump. HEROIC's breach scanner searches across more than 400 billion compromised records to determine if your email or password has been exposed in this or any known data breach. Check now and change compromised passwords immediately.