Researchers Find Hotmail InboxChecker List Exposing 857 Logins

On July 6, 2026, a file called "Hotmail InboxChecker" turned up on Telegram, uploaded by a user distributing stolen credentials. As the name suggests, this was not a Hotmail-branded product but a checker list, a collection of stolen Hotmail and Outlook logins that someone had tested to confirm which ones still worked. The file contained 857 records pairing email addresses with plaintext passwords and the URLs those accounts logged into.

To be clear, this is not a breach of Microsoft's own systems. Hotmail and Outlook were not hacked. Instead, this is a stealer log style credential harvest, meaning the usernames and passwords were pulled from individual users' infected devices and then filtered down to just the Hotmail and Outlook accounts.

Why This Is Dangerous

An "InboxChecker" file means someone has already verified these 857 logins actually work, which makes the list far more valuable and dangerous than raw, unverified data. The passwords are also stored in plaintext, so anyone who obtains the file can read and use them immediately, without needing to crack any encryption first.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to the compromised email accounts

Why This Matters

A Hotmail or Outlook inbox is often connected to password resets for banking, shopping, and social media accounts, which makes it a high-value target. If one of these 857 accounts belongs to you, an attacker could use it to reset passwords elsewhere, opening the door to credential stuffing, account takeover, financial fraud, or identity theft.

How an Inbox Checker List Gets Made

Lists like this usually start with malware quietly installed on a victim's computer, often through a fake download or cracked software. The malware pulls saved logins straight from the browser and sends them back to the attacker. From there, tools called "checkers" automatically test each stolen login against the real site, in this case Hotmail and Outlook, and keep only the ones that still log in successfully. What gets shared afterward, like this file, is that trimmed down, verified list.

Check If You Are Affected

You do not have to guess whether your email is one of the 857 in this list. HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked and stolen records, including checker lists like this one. Run a free scan now, and if your account shows up, change that password right away along with any other account where you reused it.