HEROIC Analysts Spot Hotmail_country Leak of 3,503 Logins

Analysts Track a Combo List Sorted by Country

HEROIC analysts observed a stealer log file called "Hotmail_country" being shared in a Telegram channel on December 12, 2024. The naming suggests the credentials inside were organized by the victim's country, a common way distributors segment large batches of stolen logins. The file contains 3,503 records, each combining a Hotmail email address, a plaintext password, and the login URL it came from.

Why This Is Dangerous

Sorting stolen credentials by country makes them more useful to attackers running region-specific scams, since a criminal targeting a particular area can pull exactly the accounts they need. Because the passwords are plaintext, HEROIC analysts noted that no additional effort is required to use any of these 3,503 logins directly against Hotmail's sign-in page.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• Login URLs for each account

Why This Matters

Country-sorted combo lists are frequently used to run localized phishing campaigns or credential stuffing attacks tailored to a specific region's banks and services. Anyone in this file who reused their email and password on other accounts is exposed to that same kind of targeted follow-up attack, not just generic automated attempts.

How Stealer Logs Work

Once information-stealing malware pulls saved browser logins from infected devices, distributors often organize the raw data into more useful categories, by email provider, by website, or by the victim's apparent country, based on details like language settings or IP address at the time of infection. A file named "Hotmail_country" reflects exactly that kind of sorting, making the stolen data easier to sell to buyers who want a specific slice of it.

Check If You Are Affected

HEROIC's free breach scanner searches more than 400 billion breached records, including sorted stealer log batches like this one, so you can quickly check whether your Hotmail address has been exposed and take action to secure it.