72 Passwords Leaked: hotmail TXTVALID uploaded by a Telegram User

A "hotmail TXTVALID" Stealer Log Surfaces on Telegram

In late April 2026, HEROIC analysts identified a stealer log labeled "hotmail TXTVALID" uploaded by a Telegram user. The log contained 72 records made up of email addresses, plaintext passwords, and the URLs those credentials belong to. The naming suggests the file was compiled specifically around validated Hotmail accounts, meaning the addresses inside have already been confirmed as active and working logins.

Why This Is Dangerous

If you use a Hotmail or Outlook account and it turns up in a log like this, the risk goes well beyond a single inbox. Email accounts are often the recovery method for banking, shopping, and social media logins, so anyone who gains access can reset passwords on other services and lock the real owner out. Because the passwords in this log are plaintext and already tied to a specific email, an attacker can log in immediately without cracking anything.

What Was Exposed

• Email addresses (Hotmail/Outlook accounts)
• Plaintext passwords
• Login URLs

Why This Matters

With 72 validated email and password pairs now circulating, the accounts in this log are at direct risk of takeover. Since email is frequently the key to resetting other passwords, a compromised Hotmail account can quickly cascade into access over banking, shopping, or social accounts, especially if any passwords were reused. That combination of email access and reused credentials is exactly what fuels identity theft and financial fraud.

How Stealer Logs Work

Stealer logs are generated by infostealer malware that infects a victim's device and quietly harvests saved browser data, including stored passwords, autofill details, and cookies, along with the web addresses they belong to. The stolen data is then packaged into a log and distributed through channels like Telegram, where this file was discovered. Logs are frequently organized or "validated" by email provider, as this one appears to be, which tells buyers exactly which accounts are confirmed to still work, making the data more valuable and more dangerous.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth checking now rather than waiting to find out the hard way. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can see immediately if your account has been exposed and change your password before anyone else uses it.