Inside Hotmail Stealer Logs: 122,865 Passwords Harvested

HEROIC uncovered a significant stealer log collection targeting Hotmail users that appeared on Telegram in February 2023. The dump, labeled "Hotmail 02.09," contains 122,865 records, each comprising a Hotmail email address, its corresponding plaintext password, and the URL where the credential was intercepted. This represents one of the larger Hotmail-specific credential harvests HEROIC has tracked.

122,865 Passwords Sitting in Plaintext

Every credential in this file is stored without any form of protection. The passwords appear exactly as users typed them, requiring no cracking tools or computational effort to exploit. For Hotmail and Outlook users, this is especially concerning because these accounts often serve as recovery addresses for other services, giving attackers a potential foothold to reset passwords across a victim's entire digital life.

What Was Exposed

• Email Addresses — Hotmail and Outlook accounts specifically targeted
• Plaintext Passwords — fully readable with no encryption layer
• URLs — documenting the login pages where credentials were captured

How Credential Stuffing Exploits This Data

With over 122,000 email-password pairs in hand, attackers deploy automated credential stuffing tools that test each combination against dozens of popular services within minutes. A compromised Hotmail account is particularly valuable because it can be used to intercept password reset emails for banking, social media, and shopping accounts. The sheer volume of this dump makes it a high-value resource for organized cybercriminal operations.

The Technical Mechanics of Infostealer Malware

Infostealers like RedLine, Raccoon, and Vidar are the tools behind collections like this one. They operate by injecting into browser processes to extract saved credentials from the password manager, capturing form data as it is submitted, and stealing session cookies that can bypass multi-factor authentication. The malware packages all captured data into structured log files, which are then sold in bulk or distributed free on Telegram to attract buyers for premium data sets.

Check If Your Credentials Were Exposed

With over 122,000 Hotmail accounts in this single dump, the scale of potential impact is substantial. HEROIC's breach scanner indexes more than 400 billion compromised records, making it the most comprehensive way to check whether your Hotmail credentials or any other account information has been exposed. Search now to determine your risk and take immediate action to secure any compromised accounts.