Hotmail Users Targeted: 721 Passwords Exposed in Stealer Log

HEROIC analysts discovered a stealer log labeled "Hotmail" that was uploaded to a Telegram channel on June 20, 2026. The file contains 721 records specifically targeting Hotmail email account holders. Each record includes the victim's email address, their plaintext password, and the URLs they were visiting when the malware captured their credentials.

Although 721 records may seem modest compared to larger dumps, Hotmail accounts often serve as recovery addresses for banking, social media, and cloud storage services. Compromising even one of these accounts can unlock a chain of connected platforms.

Why Plaintext Passwords Are an Immediate Danger

The passwords in this stealer log are stored in plaintext, which means they require no decryption or hash cracking. Any individual who downloads this file from Telegram can immediately use these credentials to attempt logins. Automated attack tools can cycle through all 721 email-password pairs across dozens of popular services within minutes.

Hotmail accounts are especially valuable to attackers because they often function as Microsoft account logins. A compromised Hotmail password may grant access to OneDrive, Outlook, Xbox, and other Microsoft services tied to the same credentials, dramatically expanding the scope of potential damage.

What Was Exposed in the Hotmail Dump

• Email Addresses — Hotmail email accounts that serve as both login credentials and recovery addresses for numerous third-party services.
• Plaintext Passwords — Unencrypted passwords captured directly from victims' browsers, ready for immediate use without any technical effort.
• URLs — Website addresses that victims were accessing at the time of credential theft, mapping out which services are directly exposed to account takeover.

Why 721 Compromised Accounts Pose a Wider Threat

Credential-stuffing attacks multiply the impact of every stolen password. Research shows that the majority of internet users reuse the same password across multiple accounts. Attackers armed with 721 Hotmail credentials will test each one against Gmail, Amazon, PayPal, Netflix, and dozens of other platforms using automated tools that run around the clock.

Because Hotmail addresses are frequently used as primary recovery emails, a successful login can trigger password resets on linked accounts. This gives attackers a pathway to compromise far more than just the victim's email, potentially accessing financial, healthcare, and professional accounts as well.

How Stealer Logs Capture Your Login Details

Infostealer malware typically arrives through phishing emails, fake software downloads, or compromised websites. Once it infects a device, it silently harvests saved passwords from web browsers, records keystrokes, and steals session cookies. All captured data is compiled into a structured log file that gets sent back to the attacker.

These log files are then traded or given away on Telegram channels, where they reach a wide audience of threat actors. The Hotmail-focused nature of this particular dump suggests the attacker either filtered a larger dataset or specifically targeted users of Microsoft email services.

Check If Your Credentials Were Exposed

If you use or have ever used a Hotmail email address, your credentials may be present in this leak. HEROIC provides a free breach scanner that searches over 400 billion records from stealer logs, data breaches, and dark web marketplaces to determine whether your information has been compromised.

Run a scan today to find out if your Hotmail account appears in this dump or any other known breach. If your credentials are found, change your password immediately and enable two-factor authentication on all connected accounts.