Search Now: Hotmail Full Capture by Moon_Supp1 Leaked 6,396 Logins

Search Your Email: "Hotmail Full Capture by Moon_Supp1" Leaked 6,396 Logins

HEROIC analysts identified a stealer log named "Hotmail Full Capture by Moon_Supp1" that was posted to Telegram on June 28, 2025. The file contains 6,396 records, each one pairing an email address with a plaintext password and the URL of the site the login was used on. The uploader's handle, Moon_Supp1, appears directly in the file's name, a common practice among stealer log distributors who brand their releases to build a reputation within Telegram trading channels.

Why This Is Dangerous

Every password in this log is stored in plaintext, so an attacker can use the data immediately without cracking or decrypting anything. Each of the 6,396 records already tells an attacker exactly which email, password, and site to try, and the file's focus on Hotmail suggests many of the captured logins are tied directly to Microsoft email accounts, which are often used as the recovery method for other services.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs and endpoints tied to each login

Why This Matters

A compromised email account is especially valuable to an attacker because it can be used to intercept password reset links for banking, shopping, and social media accounts. If you have reused a Hotmail password anywhere else, or used your Hotmail account as a recovery email, a leak like this can quickly turn into credential stuffing attempts or full account takeover across multiple services, not just the original one.

How Stealer Logs Work

Stealer malware infects a device, often through pirated software, cracked applications, or malicious attachments, and then silently copies saved passwords and autofill data straight out of the browser. That stolen information is bundled into a log file and sent back to the attacker automatically, typically through a Telegram bot built specifically for this purpose. Branded logs like this one, tied to a specific uploader's handle, are frequently shared to build a following before more valuable or exclusive data is sold privately.

Check If You Are Affected

You can search for your own email address right now to see if it appears in this leak or any other. HEROIC's free breach scanner checks against a database of more than 400 billion leaked records, including stealer logs like this one, so you can confirm your exposure in seconds and update any passwords that need it.