Inside Combolist 45K Hotmail: How Malware Got 39,801 Login Credentials

HEROIC analysts identified this stealer log on 21-Sep-2025. The breach exposed 39,801 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Combolist 45K Hotmail Fresh 100, uploaded by a Telegram user.

Why This Is Dangerous

This combolist specifically targets Hotmail and Microsoft account holders with credentials that have been labeled as fresh and verified. Fresh credentials are especially dangerous because they have not yet been changed by account owners who may not know they are compromised. Each of the 39,801 records in this list represents an active account that attackers can access right now.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• URLs (website addresses associated with each credential)

Why This Matters

With 39,801 freshly verified Hotmail credentials now in the hands of criminals, the window for account takeover is open. Microsoft accounts are used for email, OneDrive storage, Xbox gaming, and Microsoft 365 productivity tools. A compromised Hotmail account can also be used to reset passwords for banking and shopping accounts, leading to identity theft and financial fraud.

How a Stealer Log Works

Malware known as an infostealer installs itself on a victim's computer through phishing emails, cracked software downloads, or malicious browser extensions. It runs in the background and collects all saved passwords and the websites they belong to. These credentials are then bundled into a combolist and shared across dark web forums and encrypted Telegram channels.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.