HEROIC Discovers Hotmail Test VIP Leak: 689 Records Exposed

In June 2026, HEROIC analysts discovered a file titled "Hotmail Test VIP" circulating on Telegram, containing 689 records of Hotmail account credentials. Despite the "test" label, the data was a real stealer log dump, including email addresses, plaintext passwords, and the URLs of the login pages those credentials were used on, information pulled from infected devices rather than from Microsoft's own systems.

Why This Is Dangerous

Names like "test" or "VIP" attached to leaked files are often just labels sellers use to organize or market their stolen goods, they do not make the underlying data any less real or usable. Each of the 689 records here pairs a working email address with its plaintext password and the exact site it unlocks, meaning an attacker can attempt to log in immediately without cracking a single character or guessing which service the credentials belong to.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A Hotmail or Outlook account frequently sits at the center of a person's digital identity, used to verify logins and reset passwords for banking, shopping, and social media. Even at 689 records, this leak represents 689 real people whose inbox could be accessed if their credentials are still valid, opening the door to account takeover. Anyone who reused this password on another site faces added risk too, since attackers commonly test stolen logins across multiple platforms through credential stuffing.

How Stealer Logs Work

Stealer logs are generated by malware that infects a device, commonly through pirated software, fake updates, or malicious attachments, then quietly harvests saved browser passwords, autofill data, and active login sessions. That raw data gets organized into files like this one, sometimes labeled with names such as "test" or "VIP" to indicate how the seller has grouped or priced the batch, before being shared or sold through Telegram channels and dark web marketplaces. Regardless of the label, the underlying credentials are drawn from real, infected accounts.

Check If You Are Affected

If you use a Hotmail or Outlook account, it is worth checking whether your credentials appear in this leak or any other. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out your exposure and update any at-risk passwords right away.