How Malware Led to 293 Stolen Hotmail Logins

In March 2026, HEROIC discovered a stealer log titled Hotmail Hits Lucia899746 being distributed on Telegram. This dataset contains 293 records specifically targeting Hotmail (now Outlook) email users. Each entry pairs a Hotmail email address with a plaintext password and the URL where the credential was intercepted, providing a direct pathway for attackers to infiltrate victims' Microsoft email accounts.

Plaintext Hotmail Passwords Are an Open Door

The passwords in this leak appear in their raw, unprotected form. No decryption or cracking is needed to use them. For Hotmail and Outlook accounts, this is especially concerning because Microsoft accounts often link to OneDrive, Office 365, Skype, Xbox, and other Microsoft services. A single plaintext password from this dataset could grant an attacker access to an entire ecosystem of connected Microsoft products and the sensitive data stored within them.

What Was Exposed

• Hotmail/Outlook email addresses
• Plaintext passwords
• URLs of accessed services

From One Hotmail Password to Total Account Compromise

Credential stuffing attacks are particularly effective against Hotmail users because many people use their Microsoft email as the primary recovery address for other services. Attackers test the stolen Hotmail credentials against banking websites, e-commerce platforms, social media networks, and cloud services. When a password matches, they gain access. If the Hotmail account itself is compromised, attackers can also intercept password reset emails, effectively locking the victim out of every account linked to that address.

The Story Behind Stealer Logs Targeting Email Providers

Infostealer malware specifically seeks out email provider credentials because of their high value on underground markets. The malware infiltrates a device through deceptive means, typically a phishing link or a malicious download, and begins silently recording every credential stored in the browser. Email login pages are prioritized because they serve as the foundation of a victim's online identity. The Hotmail Hits Lucia899746 dataset was compiled from such stolen credentials and shared on Telegram, where it becomes ammunition for further attacks.

Check If Your Credentials Were Exposed

HEROIC's breach database spans over 400 billion records collected from thousands of known data breaches and stealer logs. Enter your Hotmail or Outlook email address in the HEROIC breach scanner to check if your credentials were included in the Lucia899746 leak or any other compromise. If your account has been exposed, change your Microsoft account password immediately and enable two-factor authentication to secure your entire Microsoft ecosystem.