648 Plaintext Hotmail Passwords Were Just Dumped on Telegram

HEROIC analysts flagged a stealer log titled "648x UHQ Hotmails" that was uploaded to a Telegram channel on June 22, 2026. The file contains 648 records of verified Hotmail credentials, each including the victim's email address, plaintext password, and the URLs they were visiting when the infostealer malware harvested their data. The "UHQ" designation confirms these credentials were tested and validated before distribution.

Despite the smaller size of this dump, every credential has been pre-verified as a working login. This makes it a high-value resource for attackers who prioritize quality over quantity, as each entry represents a confirmed pathway into a real Hotmail account.

Why Plaintext Passwords Eliminate Every Defense

The passwords in this dump are fully readable, stored without any form of hashing or encryption. An attacker who obtains this file can begin logging into Hotmail accounts within seconds. There is no technical barrier, no cracking process, and no time delay between obtaining the credentials and exploiting them.

For Hotmail users, this is particularly concerning because Hotmail credentials often serve as Microsoft account logins. A single plaintext password can unlock access to Outlook email, OneDrive file storage, Microsoft 365 applications, and Xbox accounts, all tied to the same authentication system.

What Was Exposed in the 648x UHQ Hotmails Dump

• Email Addresses — Verified Hotmail accounts that function as gateways to the broader Microsoft ecosystem, including Outlook, Teams, and OneDrive.
• Plaintext Passwords — Confirmed working passwords extracted from victims' browsers, providing attackers with guaranteed initial access.
• URLs — Records of the websites victims were using when their data was stolen, giving attackers a prioritized list of additional accounts to compromise.

Why Even 648 Verified Credentials Create Serious Risk

The quality of credentials matters more than quantity when it comes to account takeover attacks. Each of these 648 verified logins represents a real person whose Hotmail account is confirmed accessible. Attackers do not need to waste time sorting through dead accounts or changed passwords.

From each compromised Hotmail inbox, attackers can initiate password resets for every service linked to that email address. Banking notifications, social media recovery codes, and workplace communication all flow through email. With 648 verified entry points, the potential for downstream compromise extends to thousands of secondary accounts across the web.

How Stealer Logs Target Hotmail Users Specifically

Infostealer malware infects devices indiscriminately, capturing all saved browser credentials regardless of the email provider. However, after collection, threat actors often sort and filter the raw data by email domain to create provider-specific dumps. Hotmail-targeted files like this one are created by extracting only the @hotmail.com and @hotmail.co.uk entries from a larger dataset.

This filtering serves a purpose in underground markets. Buyers interested in Microsoft account access prefer curated Hotmail dumps because they know every credential grants entry to the Microsoft ecosystem. The UHQ verification step adds further value by eliminating non-functional accounts from the list, resulting in a compact but potent collection of confirmed logins.

Check If Your Credentials Appear in This Leak

If you currently use or have previously used a Hotmail email address, your credentials could be among the 648 records in this verified dump. HEROIC offers a free breach scanner that searches over 400 billion records from stealer logs, data breaches, and dark web sources to identify compromised accounts.

Search your Hotmail address now to find out if your login was exposed. If your credentials appear in this or any other breach, change your Microsoft account password immediately, enable multi-factor authentication, and review your account activity for any signs of unauthorized access.