Researchers Link ‘CHEETAH 1’ Combolist to 3,590 Stolen Hotmail Logins

HEROIC analysts traced a combolist called "3.6K Just Hits Hotmail" back to a Telegram post credited to a user going by CHEETAH 1, dated 04-Mar-2025. The file contains 3,590 records, each pairing a Hotmail address with a plaintext password, along with the URLs those logins were captured from.

Why This Is Dangerous

This list was built specifically around Hotmail accounts, which means the seller or uploader has already done the filtering work an attacker would otherwise have to do. Because a Hotmail or Outlook inbox is often the recovery address for banking, shopping, and social accounts, gaining access to one email account can open the door to several others through password reset links.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

With 3,590 working Hotmail logins in hand, an attacker can attempt credential stuffing not just against Microsoft services but against any site where the account owner reused that same password. Because email accounts are frequently used to reset passwords elsewhere, a compromised Hotmail login can quickly cascade into account takeover across banking, shopping, and social media platforms, opening the door to financial fraud and identity theft.

How This Combolist Was Built

Lists like this one, often labeled with a count and a target service such as "Hotmail," are typically the output of checker tools that test large batches of leaked or guessed credentials against a specific email provider and keep only the pairs that successfully log in. The result is then packaged and sold or shared on Telegram as a ready to use list of confirmed working accounts, which makes it more dangerous than an unverified combolist.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth checking whether it appears in this leak or any other breach in HEROIC's records. HEROIC's free breach scanner searches a database of more than 400 billion exposed records in seconds. If your email shows up, change your password immediately and update it anywhere else you may have reused it.