The Hotmail Fresh Leak: 367 Inbox Logins Just Went Up for Grabs

HEROIC analysts identified a stealer log dataset labeled "Hotmail Fresh," uploaded to a Telegram channel on July 1, 2025. The file contains 367 records made up of email addresses, plaintext passwords, and the URLs of the sites those credentials were used on, with the naming suggesting a focus on recently harvested Hotmail and Outlook accounts.

Why This Is Dangerous

Someone with access to this file can log directly into any of these 367 inboxes right now. Once inside an email account, an attacker can read private conversations, see what other services are linked to that address, and use password reset emails to break into banking, shopping, or social media accounts, all without the victim knowing anything is wrong.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because these are plaintext passwords tied to active email accounts, the immediate risk is direct account takeover of the inbox itself. From there, the danger multiplies through password reset abuse on other services, and if any of these 367 people reused their email password elsewhere, credential stuffing attacks become an additional threat to their other accounts too.

How Stealer Logs Work

This data comes from infostealer malware that infects a device through phishing links, cracked software, or fake downloads, then quietly extracts saved browser passwords, autofill entries, and active login sessions. The label "fresh" indicates the credentials were recently harvested and are more likely to still be valid, which is exactly why sellers highlight this in the file name before sharing it on Telegram.

Check If You Are Affected

If you use a Hotmail or Outlook account, it's worth checking whether your login shows up in a leak like this one. HEROIC's free breach scanner searches a database of more than 400 billion exposed records to give you an instant, clear answer.