Hotmail Users Are the Target in MrAwexx’s 649-Login Combolist Leak

HEROIC analysts identified a combolist titled "Hotmail Valid By MrAwexx" uploaded to a Telegram channel on December 17, 2025. The file contains 649 records pairing email addresses with plaintext passwords and the URLs those logins were tied to, with the uploader claiming the credentials are confirmed working Hotmail logins. Why This Is Dangerous: The uploader's label of "valid" matters here. Unlike a raw, unverified dump, this file is being marketed specifically because the credentials are claimed to still work, which means the barrier between an attacker and access to these inboxes may be lower than with older, unverified leaks. What Was Exposed: Email addresses, specifically Hotmail and related Microsoft accounts. Plaintext passwords. URLs identifying the login pages the credentials were captured from. Why This Matters: A working Hotmail or Outlook login often unlocks far more than email. It can be used to reset passwords on other accounts, access saved files in OneDrive, or intercept two-factor authentication codes sent by email, making it a common entry point for wider account takeover. How a Combolist Like This Gets Made: Sellers and uploaders like the one behind this file often test batches of leaked credentials against the target service before packaging them, then advertise the "valid" ones separately to increase their value on Telegram and dark web marketplaces. That testing step is what makes small, curated lists like this one worth watching closely despite the modest record count. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records. If you use a Hotmail, Outlook, or Microsoft account, run a scan now to see if your login appears in this or another exposed file.