Hotmail TXTVALID uploaded by a Telegram User: 674 Records Leaked

In April 2026, HEROIC analysts found a stealer log labeled Hotmail TXTVALID, uploaded to a Telegram channel by an unnamed user. The file contained exactly 674 records, each pairing an email address with a plaintext password and the URL of the account it unlocks. As the name suggests, this log appears to be a collection of validated Hotmail and related Microsoft account logins pulled from devices already infected with password stealing malware.

Why This Is Dangerous

Because the 674 passwords in this file are stored in plaintext, no additional work is needed before they can be used. Each record includes the matching login URL, so anyone who obtains the file can attempt to sign into the associated email account immediately. A validated list like this is particularly useful to attackers because it has already been filtered down to logins that are confirmed to work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs for the associated login pages

Why This Matters

Email accounts are often the key to everything else. If an attacker can log into one of these 674 Hotmail accounts, they can use it to reset passwords on banking, shopping, and social media accounts tied to that same address. Because the passwords are plaintext and already labeled as validated, the usual barrier of guessing which passwords still work has already been removed.

How Stealer Logs Work

Stealer logs are generated by infostealer malware that infects a device, often through pirated software, fake downloads, or malicious email attachments, and then quietly harvests saved passwords and autofill data from web browsers. That stolen information is sent back to the attacker, who may then test each login to confirm it still works before repackaging the validated list, exactly like this Hotmail TXTVALID file, for sale or distribution on Telegram and dark web channels.

Check If You Are Affected

If you use a Hotmail or Microsoft account, it is worth checking whether your login is among these 674 records. HEROIC's free breach scanner searches a database of more than 400 billion breached records, including stealer logs like this one, so you can find out in seconds if your email has been exposed and change your password before it is used against you.