Email Users Targeted: Outlook 0816 Exposes 13,409 Passwords

HEROIC analysts detected a stealer log collection labeled "Outlook New 0816" posted to a Telegram channel in May 2023. The collection specifically targets Microsoft Outlook and email service credentials, containing 13,409 compromised records. Each entry pairs an email address with a plaintext password and the URL of the service where the login was captured. The "New" designation suggests these are recently harvested credentials intended for immediate exploitation.

Why Exposed Email Passwords Create a Domino Effect

The 13,409 passwords in this dump are stored in plaintext — completely unencrypted and instantly usable. For email accounts, this is particularly devastating. Email serves as the recovery mechanism for virtually every other online account. When an attacker controls your email, they can reset passwords on banking sites, shopping accounts, cloud services, and social media platforms without triggering any alarms.

Plaintext exposure eliminates the time buffer that hashed passwords provide. There is no cracking phase, no brute-force computation, and no technical skill required. The attacker simply reads the password and logs in, often within minutes of the data appearing online.

What Was Exposed in the Outlook 0816 Dump

• Email Addresses — Microsoft Outlook and other email provider addresses used as primary login credentials, recovery contacts, and communication channels across dozens of services.
• Plaintext Passwords — Unencrypted, human-readable passwords captured from browser password managers and email client configurations on compromised machines.
• URLs — Login endpoints and service addresses that reveal exactly which platforms each victim accessed, enabling precision-targeted account takeover.

Why 13,409 Email Credentials Punch Above Their Weight

Email credentials are the highest-value targets in any stealer log because they function as master keys. With access to a victim's email account, an attacker can intercept password reset links, read two-factor authentication codes sent via email, access sensitive financial documents, and impersonate the victim in communications with contacts, employers, or institutions.

The threat multiplies because most people use the same password for their email account and other services. With 13,409 email-password pairs, credential-stuffing attacks can systematically probe major platforms — banking portals, cloud storage, corporate VPNs, and e-commerce sites — using each pair. A single match on a financial service can result in direct monetary loss within hours.

How Stealer Logs Specifically Harvest Email Credentials

Infostealer malware does not discriminate between types of credentials, but email account data is among the first things it extracts. When malware like Lumma Stealer or Meta Stealer infects a device, it scans browser password databases, desktop email client configurations, and cached login tokens. If a victim has their Outlook password saved in Chrome, Firefox, or Edge, the malware captures it in seconds.

After extraction, the stolen data is organized into log files by the malware operator. Email-focused collections like Outlook New 0816 are curated specifically to appeal to attackers who specialize in email account takeover and business email compromise schemes. These targeted datasets are shared on Telegram where they quickly circulate among fraud groups and social engineering operators.

Check If Your Email Credentials Were Exposed

Anyone who uses Microsoft Outlook or similar email services and has saved their password in a browser or email application should verify whether their credentials appear in this collection. Email account compromise can escalate faster than any other type of breach because of the central role email plays in account recovery.

Use HEROIC's free breach scanner to search for your email address or passwords across the Outlook New 0816 dump and over 400B+ compromised records in our database. If your credentials are found, change your email password immediately, enable multi-factor authentication, and check for any unauthorized forwarding rules or recently sent messages you do not recognize.