Dark Web Intel: The ‘Hotmail Fresh B4_Jx’ Leak Has 4,883 Logins

HEROIC analysts monitoring dark web and Telegram channels identified a combolist labeled Hotmail Fresh B4_Jx, dated May 22, 2026, containing 4,883 records of Hotmail email addresses paired with plaintext passwords and the URLs those credentials unlock. Why this is dangerous: files labeled 'fresh' are marketed to other criminals as recently harvested and largely untested by defenders, which typically makes them more valuable and more likely to still work when someone tries logging in. The plaintext passwords mean no additional effort is needed before the credentials can be used. What was exposed: Hotmail email addresses, plaintext passwords, and the URLs tied to each set of credentials. Why this matters: intelligence like this shows how quickly stolen Hotmail credentials move through private Telegram groups after they are harvested. Once distributed, they get tested against other sites through credential stuffing, and any reused password can lead to account takeover, identity theft, or financial fraud well beyond the original Hotmail inbox. How combolists work: a combolist bundles email and password pairs, often sourced from stealer malware or older breaches, then labels the batch by freshness, provider, or region to help buyers gauge its value. Files marketed as 'fresh,' like this one, are typically shared quickly through private channels before the credentials are widely known to be compromised, giving attackers a narrow window to exploit them. Check if you are affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one. Run a scan to see if your Hotmail account was exposed and learn which passwords to change first.