How Malware Led to 526 Stolen Logins in the Hotmail Fresh B4_Jx Dump

HEROIC analysts traced the Hotmail Fresh B4_Jx stealer log to an April 2026 upload on a Telegram channel. Info-stealing malware running on infected devices captured 526 records containing email addresses, plaintext passwords, and the exact URLs where victims entered their credentials. The malware silently recorded every login as it happened, then packaged the data and delivered it to the attacker before it was shared publicly.

Why 526 Plaintext Passwords Paired With Login URLs Create Immediate Risk

This breach does not require any password cracking. Every credential in the Hotmail Fresh B4_Jx dump is already in plaintext, ready to use. Attackers do not need specialized tools or computing power. They simply open the file, pick a target, and log in.

The included URLs add another layer of danger. They reveal the exact websites and services each victim accessed, from email providers to banking portals and online stores. An attacker can prioritize high-value targets like financial accounts and work through the list methodically. For email accounts specifically, gaining access means the ability to intercept password reset links for every connected service.

What Was Exposed in This Stealer Log

• Email Addresses: Account identifiers tied to Hotmail and other services
• Plaintext Passwords: Fully readable, unencrypted passwords captured during login
• URLs: Website addresses showing where each set of credentials was entered

Why Stolen Email Credentials Open the Door to Larger Attacks

Email accounts sit at the center of most people's online identity. They serve as the recovery address for banking, shopping, social media, and workplace accounts. When an attacker controls your email, they can trigger password resets across dozens of services without you noticing until it is too late.

Beyond direct account takeover, these credentials feed automated credential stuffing operations. Attackers load stolen email and password pairs into bots that test them against popular services at scale. Because password reuse remains widespread, a single valid combination often unlocks multiple accounts belonging to the same person.

How Stealer Malware Captures Your Credentials

The Hotmail Fresh B4_Jx dump was created by info-stealer malware, a type of program designed to harvest credentials directly from infected devices. These infections typically begin with a phishing email containing a malicious attachment, a fake software download, or a compromised website that triggers an automatic download.

Once running on a device, the malware operates invisibly. It extracts saved passwords from web browsers, records keystrokes as users type, and monitors clipboard activity for copied passwords. Some variants also steal browser cookies and session tokens, allowing attackers to bypass two-factor authentication entirely. The harvested data is compiled into structured log files and transmitted to the attacker's server, where it is organized and eventually distributed through channels like Telegram.

Find Out If Your Credentials Were Captured in This Dump

HEROIC's breach database contains over 400 billion records collected from data breaches, stealer logs, and combolists worldwide. You can run a free scan to check whether your email address or credentials appear in the Hotmail Fresh B4_Jx dump or any other known exposure. If you find a match, change your password immediately on every account that uses the same credentials, enable two-factor authentication where available, and review your recent account activity for signs of unauthorized access.