HEROIC Researchers Find 518 Hotmail Logins on Telegram

HEROIC researchers monitoring dark web channels identified a stealer log simply titled "Hotmails" that was uploaded to Telegram by an anonymous user in February 2025. Upon review, the researchers found the file contained 518 records of Hotmail accounts, including email addresses, plaintext passwords, and the URLs of the login pages tied to each one.

Why This Hotmails Leak Is Dangerous

Researchers note that even a modest batch like this one carries real risk, because each record pairs a working email address with a plaintext password and the exact site it unlocks. That means whoever obtained this file doesn't need to guess or crack anything, they can attempt to log into any of the 518 accounts right away.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login sites

Why This Matters

According to HEROIC researchers, Hotmail and other email accounts are frequently used to reset passwords for banking, shopping, and social media, so a single compromised inbox can open the door to account takeover elsewhere. Anyone among the 518 affected who reused this password on other sites also faces credential stuffing, where attackers try the same login across multiple platforms.

How Stealer Logs Work

Researchers explain that stealer logs like this one are produced by malware that infects a device and silently copies whatever login information is saved in the browser, including usernames, passwords, and the websites they belong to, before sending it all back to the attacker. These files are then packaged, sometimes with plain labels like "Hotmails," and shared or sold on Telegram channels that HEROIC continues to track.

Check If You Are Affected

HEROIC researchers recommend checking your exposure directly. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can find out instantly and change your password if needed.