Inside the Hotmail.txt Stealer Log: How 1,499 Passwords Leaked

Inside the "Hotmail.txt" Stealer Log: How 1,499 Passwords Leaked

In June 2026, HEROIC's threat intelligence team identified a stealer log shared on Telegram as a file named "Hotmail.txt." It contained 1,499 records, each pairing a victim's email address with a plaintext password and the URL of the login page that credential belonged to, all focused on Hotmail and Outlook-style webmail accounts.

Why the Simple File Name Undersells the Risk

A plain text file named "Hotmail.txt" sounds unremarkable, but it functions as a ready-made key ring: 1,499 working email and password combinations, each matched to the exact webmail login page it unlocks. There's no encryption or formatting standing between an attacker and access, just a list they can open and start using immediately.

What Was Exposed in the Hotmail.txt Log

• Email addresses for 1,499 individual victims
• Plaintext passwords, stored without encryption
• URLs identifying the exact webmail login page each credential unlocks

Why This Matters More Than a Typical Password Leak

Because these are webmail credentials specifically, the risk extends beyond the inbox itself. Email accounts are used to reset passwords for banking, shopping, and social media, so an attacker who logs into one of these Hotmail accounts can often use it as a launchpad to take over several other accounts belonging to the same person, especially if passwords have been reused.

How a File Like Hotmail.txt Gets Created

Information-stealing malware infects devices through cracked software, phishing links, or malicious attachments, then quietly reads every password saved in the browser along with the site it belongs to. Whoever collects the results filters out everything tied to Hotmail and Outlook login pages and saves it as a simple, easy-to-share text file, exactly the kind of raw output these stealer logs are traded as on Telegram.

Check If Your Email Was in the Hotmail.txt Leak

The only way to know for sure is to check. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like Hotmail.txt, and tells you instantly if your email address is included. If it is, change your password immediately, avoid reusing it anywhere else, and turn on two-factor authentication on your email account right away.