Researchers Link CHEETAH Dump to 3,780 Stolen Hotmail Logins

In early March 2025, HEROIC analysts linked a Telegram post from the uploader CHEETAH, titled 3.7K Hotmail Hits Full Valid, to a stealer log containing 3,780 exposed records. Each entry pairs a Hotmail email address with a plaintext password and the URL of the login page it opens, the standard structure of data pulled by infostealer malware from an infected browser.

Researchers Link the CHEETAH Dump to 3,780 Stolen Hotmail Logins

The word Valid in the file's title indicates the uploader tested each credential before release, meaning the 3,780 accounts in this file were confirmed to be working logins at the time it was posted. That verification step makes this file more immediately dangerous than an unchecked list, since every entry represents an account an attacker can likely still access.

What Was Exposed in the Hotmail Hits File

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A verified Hotmail login gives an attacker a direct path into an inbox that likely controls password resets for other accounts. Anyone in this file who reused their Hotmail password elsewhere is exposed to credential stuffing and account takeover, and from there, financial fraud and identity theft become realistic outcomes.

How a Verified Hits File Like This Gets Made

Uploaders like CHEETAH collect raw stealer malware output, then manually or automatically test each email and password pair against the live login page before publishing, discarding any that no longer work. This verification step is what separates a full valid file from an ordinary combolist, and it is a selling point sellers use to justify charging more for access on Telegram.

Check If You Are Affected

If you use a Hotmail address, it is worth checking whether your login appears in this verified leak. HEROIC's free breach scanner searches a database of more than 400 billion compromised records so you can confirm your exposure in seconds and change your password before it is used against you.