Hotmail Fresh B4_Jx Leak: 393 Passwords Exposed Online

Hotmail Fresh B4_Jx Leak: 393 Passwords Exposed Online

On May 2, 2026, HEROIC analysts identified a stealer log named "Hotmail Fresh B4_Jx" that a Telegram user uploaded to a channel used for trading stolen credentials. The file holds 393 records, each pairing an email address with a plaintext password and the URL of the site where that password was used. The moment this file was posted, those 393 logins became available to anyone in the channel.

Why This Is Dangerous

Because the passwords are in plaintext, there's no encryption standing between an attacker and a working login. The included URLs make it worse: instead of guessing where a stolen password might work, a criminal can see exactly which site each credential unlocks and try it there first.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• URLs showing where each password was used

Why This Matters

For the 393 people affected, account takeover is an immediate risk on the sites named in the log. If any of those passwords were reused on other accounts, credential stuffing extends that risk further, and because Hotmail addresses often serve as a recovery email, a single compromised inbox can open the door to other accounts tied to it.

How This Stealer Log Was Assembled

Stealer logs like this one are produced by malware quietly running on an infected device, reading saved browser passwords and recording anything typed into login forms. Each password gets tagged with the site's URL, and the resulting data is packaged into a file that gets uploaded to Telegram, where it can be downloaded by anyone with access to the channel. The process requires no hacking of the destination sites themselves, only an infected device somewhere along the way.

Check If You Are Affected

If you use a Hotmail account, checking now is a smart move. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, to tell you whether your email or password has surfaced anywhere on the dark web. Run a free scan and change any compromised password right away.