Researchers Link Hotmail Fresh B4_Jx to 905 Stolen Credentials

HEROIC analysts identified this stealer log on 01-May-2026. The breach exposed 905 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Hotmail Fresh B4_Jx uploaded by a Telegram User.

Why This Is Dangerous

This stealer log contains 905 Hotmail account credentials, all stored in plaintext. The scale of this particular file means a significant number of Microsoft email accounts are directly at risk. Because Hotmail accounts often serve as the recovery address or login for other services, compromising one account can cascade into access across multiple platforms.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (website addresses where credentials were captured)

Why This Matters

HEROIC researchers linked these 905 stolen Hotmail credentials to a file shared on Telegram in May 2026. Once a file like this is shared in private channels, it quickly spreads to additional threat actors, multiplying the number of people who can attempt to use the stolen credentials. Attackers target Hotmail accounts because they are connected to Microsoft services, calendar data, contacts, and often workplace tools. The real-world risks include account takeover, interception of sensitive emails, and identity theft.

How a Stealer Log Works

Stealer malware is designed to run quietly on infected computers and mobile devices. It reads saved passwords from browsers such as Chrome and Edge, captures credentials from email applications, and records the URL of each account. This harvested data is compiled into a log file and sent back to the attacker. The file is then posted in Telegram channels or sold on underground markets, giving multiple parties access to the same stolen credentials.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.