Hotmail Users Targeted in Small mrbouliz Login Leak

HEROIC analysts identified a small stealer log uploaded to Telegram on July 4, 2026, labeled "Valid Hotmail mrbouliz." The file targeted Hotmail account holders specifically, containing 65 records made up of email addresses, plaintext passwords, and the URLs each login was used on. The data was harvested from devices already infected with information-stealing malware, then compiled and shared by whoever uses the name mrbouliz.

Why This Is Dangerous

Even at 65 records, the people targeted here are Hotmail users specifically, meaning whoever compiled this file filtered a larger pool of stolen data down to just the accounts they wanted. Because the passwords are stored in plaintext, each of those 65 logins can be used immediately by anyone who has the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

For the 65 Hotmail users in this file, the main risk is credential stuffing on any other account where they reused the same password, along with the possibility that their Hotmail account itself gets used to reset passwords on connected services. A small, targeted list like this is often easier for an attacker to work through in full than a massive dump would be.

How Stealer Logs Work

Stealer malware collects saved logins from an infected browser regardless of which service they belong to. Whoever controls that malware, or buys the resulting data, can then filter the results down to a specific target, in this case Hotmail accounts, and package that smaller, focused list separately before sharing it under a label like "Valid Hotmail mrbouliz."

Check If You Are Affected

Small, targeted leaks like this one rarely make headlines but can still put your accounts at risk. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, so you can confirm quickly whether your Hotmail login was part of this file.